sb-au logo
Story image

The malware that brought down Ukraine – is it really that sophisticated?

21 Jun 2017

In December last year a power blackout in Ukraine’s capital Kiev was deemed to be not just a fault in the system, but in fact a malicious cyberattack.

What is interesting, is that it was almost the same time just 12 months ago that the capital experienced a similar attack and power outage -  experts say the country appears to be a ‘testbed’ for attacks to be used around the world.

In both instances, the attacks against Ukraine’s power grid shut off critical energy systems supplying heat and light to millions of homes, showing the true potential of cybercrime.

Hackers are believed to have remained undetected in the Ukrenergo IT network for six months, planning their moves and stealing privileges to access systems before taking steps to shut down the power.

New research from ESET and Dragos Inc. has uncovered the malware responsible for the most recent attack, and they’re calling it Industroyer or CrashOverride with the potential to be more powerful than Stuxnet.

However, federal technical director for Tenable, John Chirhart says there is a lot of ‘buzz’ going around about Industroyer as one of the most sophisticated threats out there, but with no zero days in the Industroyer payload, the significance of this malware as a stand-alone event is in fact quite small.

“Security for critical infrastructure assets like industrial control systems is important, but we need to remember that malware like Industroyer, or WannaCry, represent the new normal of today’s fast-paced security environment and require a different approach,” says Chirhart.

“There’s no way to be strategic about your security if you’re always reacting to the threat of the day.”

Chirhart says as cloud and Internet of Things (IoT) reduce the distinction between operational tech like ICS/SCADA and information technology like laptops and mobile devices, most security vendors have failed to innovate at the rate of change.

This means the convergence of modern IT and OT computing assets is leaving customers struggling to discover and secure all of the devices on their networks.

“Single use ‘best of breed’ security products are no longer enough. CISOs need a unified view from a single platform that can draw on active, passive and agent scanning to see everything from containers to MRI machines,” says Chirhart.

“Stop chasing the latest headline-breaking threat and instead, implement a strategic and agile security program to proactively manage cyber risk for the modern enterprise. That’s what separates a world-class cyber organization from a mediocre one.”

Story image
Palo Alto Networks adds more incentives to NextWave partner program
This latest launch brings a significant set of enhancements, incentives and training to the company’s NextWave Partner Program.More
Story image
Quantum extends Veeam partnership in a bid to protect against ransomware
“Quantum continues to expand its partnership with us and we are pleased to add ActiveScale object storage to a select group of S3 targets that can provide robust ransomware protection for our joint customers."More
Story image
Organisations investing significant time modifying web application firewalls to keep ahead of cybersecurity threats
"The sheer amount of traffic and potential threats can ensnare resources and impact the ability to introduce greater precision to those key systems."More
Story image
Kaseya acquires RocketCyber to bring SOC solutions to more businesses
"With this acquisition, we've doubled down on our security investments to provide our customers with access to experts who can continuously monitoring their IT environments without the cost and complexity of disparate tools.”More
Story image
Stone & Chalk and AustCyber confirm strategic merger
"The integration of Stone & Chalk and AustCyber will enable our joint organisation to pursue a resilient and prosperous future not just for founders, enterprise and governments, but for all of Australia.”More
Story image
ExtraHop reveals methods used by attackers in SUNBURST breach
The network detection and response company says between late March and early October 2020, detections of probable malicious activity increased by approximately 150%, including detections of lateral movement, privilege escalation and command and control beaconing.More