Six factors have been identified as the key contributors to the success of Advanced Persistent Threat (APT) operations inside their victims’ networks.
According to Kaspersky, the six factors are human factors, insufficient security measures, challenges with updates and configuration of cybersecurity solutions, explaining that while some of these reasons may appear trivial, they are frequently encountered by Kaspersky experts during their incident response activities. To assist companies to mitigate related threats and to ensure the implementation of best practices.
Lack of OT network isolation
During incident investigations, Kaspersky experts witnessed cases when there were problems with keeping the Operational Technology (OT) network separate and secure. For example, there are machines such as engineering workstations connected to both the regular IT network and the OT network.
“In situations where the OT network’s isolation solely relies on the configuration of networking equipment, experienced attackers can always reconfigure that equipment to their advantage,” said Evgeny Goncharov, Head of Industrial Control Systems Cyber Emergency Response Team at Kaspersky. “For instance, they can turn it into proxy servers to control malware traffic or even use it to store and deliver malware to networks that were believed to be isolated. We have witnessed such malicious activities on multiple occasions.”
Human factor remains a driver of cybercriminal activities
When granting access to OT networks to employees or contractors, information security measures are often overlooked. Remote administration utilities like TeamViewer or Anydesk, initially set up temporarily, may remain active unnoticed. However, it’s crucial to remember that these channels are easily exploited by attackers. In 2023, Kaspersky investigated an incident where a contractor attempted sabotage, by taking advantage of remote access to the ICS network legitimately granted to them several years before.
This story demonstrates the importance of considering the human factor as any potentially dissatisfied employees may be driven by their work assessments, income, or political motivations, leading them to engage in cybercriminal actions. A possible solution in such a situation can be Zero Trust – the concept assuming that neither the user, device, nor application within the system is trusted. Unlike other Zero-Trust solutions, Kaspersky extends Zero Trust approach down to the Operating System level with its KasperskyOS-based solutions.
Insufficient protection of OT assets
During incident analysis, Kaspersky experts discovered outdated security solution databases, missing license keys, user-initiated removal of keys, disabled security components, and excessive exclusions from scanning and protection – all contributing to the spread of malware.
For example, if your databases are not up-to-date and a security solution can’t be updated automatically, it can allow advanced threats to quickly and easily propagate as in APT attacks, where sophisticated threat actors are trying to avoid detection.
Insecure configurations of security solutions
Proper configurations of a security solution are crucial to prevent it from disabling or even abusing it – a tactic that has often seen to be employed by APT groups/actors. They may steal information on the victims’ network stored in the security solution to get into other parts of the system or move laterally, using professional infosec language.
In 2022, Kaspersky ICS CERT noticed a new trend in APT tactics, which makes proper configurations even more vital. For instance, when searching for ways to move laterally, the attackers no longer stop at hijacking critical IT systems, like domain controllers. They proceed to the next target – the administration servers of security solutions. The goals may vary – from putting the malware on a list of programs that won’t be checked to using tools in the security system to spread it to other systems, even those that are supposed to be completely separate from the infected network.
The absence of cybersecurity protection in OT networks
It might be hard to believe, but on some OT networks, cybersecurity solutions are not installed on many endpoints at all. Even if the OT network is completely separated from other networks and not connected to the Internet, attackers still have ways of gaining access to it. For example, they can create special versions of malware that are distributed via removable drives, such as USBs.
Workstations and servers’ security updates challenges
Industrial control systems have a unique way of functioning, where even simple tasks like installing security updates on workstations and servers need careful testing. This testing often happens during scheduled maintenance, causing updates to be infrequent. This gives threat actors plenty of time to exploit known weaknesses and carry out their attacks.
“In some cases, updating the server’s operating system may require updating specialised software (like the SCADA server), which in turn requires upgrading the equipment – that all may be too expensive. Consequently, there are outdated systems found on industrial control system networks,” adds Goncharov. “Surprisingly, even Internet-facing systems in industrial enterprises, which can be relatively easy to update, can remain vulnerable for a long time. This exposes the operational technology (OT) to attacks and serious risks, as real-world attack scenarios have shown.”