The latest Operational Technology (OT)/IoT security report from Nozomi Networks Labs finds wiper malware, IoT botnet activity, and the on-raging Russia-Ukraine war impacted the threat landscape in the first half of 2022. Since Russia began its invasion of Ukraine in February 2022, Nozomi Networks Labs researchers saw activity from several types of threat actors, including hacktivists, nation-state advanced persistent threats (APTs), and cyber criminals.
What were the findings the Nozomi’s study?
They observed the robust usage of wiper malware, and the emergence of an Industroyer malware variant (used in the attack on Ukraine’s power grid), dubbed Industroyer2, developed to misuse the IEC-104 protocol, commonly used in industrial environments.
In the first half of 2022, malicious IoT botnet activity was on growing in sophistication. Nozomi Networks Labs set up a series of honeypots to attract these malicious botnets and capture their activity in order to provide additional insights into how threat actors target IoT.
Hard-coded passwords not as secure
Nozomi uncovered growing security concerns for hard-coded passwords and internet interfaces for end-user credentials. From January to June 2022, Nozomi honeypots found:
- March was the most active month with close to 5,000 attacker IP addresses collected.
- The top attacker IP addresses were associated with China and the United States.
- ‘root’ and ‘admin’ credentials were most often targeted and used in multiple variations as a way for threat actors to access all system commands and user accounts.
Manufacturing and energy most vulnerable
On the vulnerability front, manufacturing and energy continue to be the most vulnerable industries followed by healthcare and commercial facilities. In the first six months of 2022:
- Cybersecuriy & Infrastructure Security Agency (CISA) released 560 Common Vulnerabilities and Exposures (CVEs) – down 14% from the second half of 2021
- The number of impacted vendors went up 27%
- Affected products were also up 19% from the second half of 2021
What were Nozomi’s thoughts on the findings?
“This year’s cyber threat landscape is complex. Many factors including increasing numbers of connected devices, the sophistication of malicious actors, and shifts in attack motivations are increasing the risk for a breach or cyber-physical attack. Fortunately, security defences are evolving too,” said Roya Gordon, Nozomi Networks OT/IoT Security Research Evangelist.
“Solutions are available to give critical infrastructure firms the network visibility, dynamic threat detection, and actionable intelligence needed to minimise risk and maximise resilience.”
What is the purpose of the OT/IoT Security Report?
Nozomi Networks’ “OT/IoT Security Report” provides security professionals with the latest insights needed to re-evaluate risk models and security initiatives, along with actionable recommendations for securing critical infrastructure. This latest security report includes:
- A review of the current state of cybersecurity
- Trends in the threat landscape, and solutions for addressing them
- A recap of the Russia/Ukraine crisis, highlighting new related malicious tools and malware
- Insights into IoT botnets, corresponding indicators of compromises (IoCs) and threat actor tactics, techniques and procedures (TTPs).
- Recommendations and forecasting analysis
