English
Français
Español
עברית
Deutsch
日本語
한국어
中文
JBS and Colonial Cyber Attack | OT Ransomware Trend Continues
The latest on the Colonial Pipeline and JBS Cyber Attacks – Are you at risk?
June 15, 2021
The latest on the Colonial Pipeline and JBS Cyber Attacks – Are you at risk?
Learn how hacktivists can exploit security updates on vendors’ websites to cause an ICS shutdown, something like the Havex/Dragonfly malware
Why is it, that the Colonial pipeline had to be shut down? Targeted ransomware can affect physical operations in one of three ways…
Watch: This attack on the Colonial pipeline is consistent with recent trends. Targeted ransomware has emerged the most capable of today’s “commonplace” attacks.
Remote support turns into remote attack. Outsourcing a support functions allows a disgruntled vendor technician to use legitimately acquired remote access credentials to shut down a water treatment plant
Learn how hacktivists pivot through poorly-defended sites and poorly-defended cloud services into heavily-defended targets.
Defeating a a jump host with 2-factor authentication. Attackers use spear-phishing and custom malware attachments to target technicians authorized to log into a jump host. A technician activates their VPN and logs in using two-factor authentication. This activates the malware, giving attackers control of the remote desktop window.
Cell phone supply chain attack – attackers write a free cell-phone app. When cell phones with the app are carried into industrial control systems, the app scans for WiFi access points and reports the details over the Internet. Attackers then use phishing to extract the passwords for these networks and log in using the compromised cell phones.
Attackers write their own RAT malware & deploy on the IT network of a services company known to service the real target. The attackers compromise the laptops of personnel who routinely visit the real target and gain a foothold on the real target’s IT network, ultimately propagating to the ICS network