Energy providers hacked through malicious software updates

Symantec says the Dragonfly campaign, originating in Eastern Europe, sought to gain persistent access to energy suppliers

Eastern European-based attackers gained access to the networks of energy providers by tampering with software updates for industrial control systems, gaining a foothold that could be used for sabotage, Symantec said Monday.

The Dragonfly group, which appears to operate from Eastern Europe, compromised three ICS vendors, adding a piece of remote access malware to legitimate software updates, the security vendor wrote in a blog post Monday.

"Given the size of some of its targets, the group found a 'soft underbelly' by compromising their suppliers, which are invariably smaller, less protected companies," Symantec wrote.

The companies unwittingly installed the malware by downloading the software updates from the ICS vendors. Symantec did not identify the vendors, but said it had notified the victims and various computer emergency response centers.

Those affected were energy grid operators, electricity generators and petroleum pipeline operators, with the majority of them in the U.S., Spain, France, Italy, Germany, Turkey and Poland, Symantec wrote.

On Friday, an agency that is part of the U.S. Department of Homeland Security (DHS) issued an advisory on the attacks based on information it received from Symantec and the Finnish security company F-Secure.

The software updates from the three ICS vendors contained Havex, a remote access Trojan that can upload other malware to systems, according to the advisory, published by DHS's Industrial Control Systems Emergency Response Team (ICS-CERT).

Havex, which is also known as Backdoor.Oldrea or Energetic Bear, also gathers a variety of network system information and uploads it to command-and-control servers controlled by the attackers.

Symantec identified a product that provided VPN (virtual-private-network) access to PLC (programmable-logic-controller) devices from one ICS vendor that had been modified by Dragonfly.

The group also modified a driver contained within a software package from a European manufacturer of PLC devices. The modified software was available for download for at least six weeks between June and July 2013, Symantec wrote.

A third European company that develops software for managing wind turbines and bio-gas plants also hosted compromised software for 10 days in April 2014, the vendor wrote.

The Dragonfly group has been around since at least 2011. At that time, it targeted defense and aviation companies in the U.S. and Canada before shifting its attacks to energy companies in the same countries in early 2013, Symantec wrote.

It likened Dragonfly's campaign to that of Stuxnet, which was a stealthy malware attack believed to have been conceived by the U.S. and Israel that destroyed centrifuges used by Iran to refine uranium.

"While Stuxnet was narrowly targeted at the Iranian nuclear program and has sabotage as its primary goal, Dragonfly appears to have a much broader focus with espionage and persistent access as its current objective with sabotage as an optional capability if required."

Based on timestamps showing when the malware was compiled, it appears the attackers worked 9 a.m. to 6 p.m. Monday through Friday shifts in a time zone that places them in Eastern Europe, Symantec said.

Security analysts have said that such regular working patterns often indicate that a country may be sponsoring or sanctioning such attacks.

"Dragonfly bears the hallmarks of a state-sponsored operation, displaying a high degree of technical capability," Symantec wrote.

Tampering with software updates is perhaps the most clever of Dragonfly's attacks, but the group also used a variety of other methods to compromise individuals close to the companies they targeted.

Those methods included sending spam emails with malicious PDF attachments and so-called "watering hole" attacks, where spam emails with malicious links aim to lead people to websites that probe computers for software vulnerabilities.

Dragonfly employed two exploit kits, called "Lightsout" and "Hello," which are hacking platforms planted on legitimate websites that try to deliver malware to computers that visit the site, Symantec wrote.

Send news tips and comments to Follow me on Twitter: @jeremy_kirk

Join the CSO newsletter!

Error: Please check your email address.

Tags symantecsecurityf-secureExploits / vulnerabilitiesmalwareICS-CERT

More about CERT AustraliaDragonflyF-SecureSymantec

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place