Filter
07 April 2021
Vulnerability in FortiGate VPN servers is exploited in Cring ransomware attacksAn incident investigation conducted by Kaspersky ICS CERT experts at one of the attacked enterprises revealed that attacks of the Cring ransomware exploit a vulnerability in FortiGate VPN servers.
29 March 2021
APT attacks on industrial companies in 2020Overview of APT attacks on industrial enterprises information on which was published in 2020.
25 March 2021
Threat landscape for industrial automation systems. Statistics for H2 2020The statistical data presented in the report was received from ICS computers protected by Kaspersky products that Kaspersky ICS CERT categorizes as part of the industrial infrastructure at organizations.
17 March 2021
Threat landscape for the ICS engineering and integration sector. 2020The threat landscape for computers in the ICS engineering and integration sector varies depending on a computer’s environment, including its geographical location, ability to access external networks and services, and user behavior.
25 February 2021
Lazarus targets defense industry with ThreatNeedleIn mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns.
26 January 2021
SunBurst industrial victimsHow many industrial organizations had installed backdoored SolarWinds versions? We present the results of our analysis.
02 December 2020
ICS threat predictions for 2021We present our vision of what challenges industrial cybersecurity will soon be (or already is) facing, and what to expect from cybercriminals in 2021.
05 November 2020
Attacks on industrial enterprises using RMS and TeamViewer: new dataThe attacks use remote administration utilities whose graphical user interface is hidden by the malware, enabling the attackers to control the infected system without the user’s knowledge.
19 October 2020
Practical example of fuzzing OPC UA applicationsWe continue to describe our approaches to searching for vulnerabilities in industrial systems based on the OPC UA protocol. In this article, we examine new techniques that can be used to search for memory corruption vulnerabilities if the source code is available. We also discuss an example of fuzzing using libfuzzer.
13 October 2020
What it feels like for a turbineThe goal of the article is to raise awareness on security of Distributed Control Systems (DCS), propose a methodology for assessment, and a remediation strategy. Defenders are always behind attackers, and this publication is trying to balance things out.
Filter
07 November 2018
Critical vulnerabilities in AVEVA industrial softwareThe vulnerabilities affect InduSoft Web Studio and InTouch Edge HMI and could allow remote execution of arbitrary code
29 October 2018
Multiple vulnerabilities in Advantech WebAccessVulnerabilities identified in Advantech WebAccess include buffer overflow, path traversal, improper privilege management, etc.
22 October 2018
Phishing attack targeting Italian naval and defense industryThe attackers attempted to infect computers with MartyMcFly remote access Trojan using phishing emails with malicious attachments
19 October 2018
New GreyEnergy malware attacks industrial networksExperts point to the similarities between the new malware and BlackEnergy, and a possible connection of the attacks with the TeleBots criminal group
12 October 2018
Siemens fixes new vulnerabilities in its productsVulnerable products include ROX II operating system, SIMATIC S7-1200 CPU family, SCALANCE W1750D access point and some SIMATIC PLCs
10 October 2018
Multiple vulnerabilities in Wecon PI StudioWecon PI Studio HMI solutions are affected by multiple vulnerabilities that could allow remote code execution and disclosure of sensitive information, including in the context of an administrator
05 October 2018
Critical vulnerabilities in Entes EMG 12 convertersVulnerabilities in the web interface of EMG12 Ethernet Modbus Gateway devices could allow unauthorized access to the devices and the ability to change device configuration
02 October 2018
Multiple vulnerabilities in Fuji Electric industrial productsMultiple vulnerabilities affect the Alpha5 Smart Loader servo system, FRENIC Loader software, and FRENIC-Ace, FRENIC-Mini, FRENIC-Eco, FRENIC-Multi, and FRENIC-MEGA inverters
02 October 2018
Critical vulnerabilities in Emerson AMS Device ManagerExploitation of vulnerabilities in Emerson AMS Device Manager, an industrial asset control system, could allow arbitrary code execution and malware injection
20 September 2018
Dangerous vulnerabilities in Siemens industrial solutionsNewly identified vulnerabilities affect SIMATIC WinCC OA HMI system, SCALANCE X switches and TD Keypad Designer tool
Filter