Threat of nation-state attacks is growing

What is a nation-state attack and why is the energy sector at risk?

A nation-state attack is a type of cyber-attack that is carried out by a state-sponsored actor on another nation's computer networks. These attacks can be used to disrupt government operations, steal sensitive data, or even cause physical damage. Nation-state attacks are usually highly organised and sophisticated and can be difficult to detect and defend against due to their complexity.

With that in mind, it’s no surprise that a nation’s energy sector would become an attractive target for different types of threat actors, each with its own reasons and goals. Nation-state actors are particularly interested in the energy sector for economic and geopolitical reasons; it is a vital infrastructure that could be used as a weapon against an adversary.

For example, a nation-state may target the energy grid of a rival country to cause a blackout, which could be used to weaken the adversary's economy or its military capabilities. Hacktivists may direct their attacks against the energy sector to publicly display their opposition to the industry's activities for environmental or ideological reasons, and cybercriminals may be attracted to the energy sector purely for financial gain.

What are the primary methods of attack?

Cyber attackers use a variety of methods to attack the energy sector. One of the most common vectors used for initial access is phishing or spear-phishing. Threat actors use lures to induce their victims to click on a link or download a file, for example, emails may be crafted around topics such as health care, job postings, holiday entitlements, or password policies. If a user then clicks on a malicious link or downloads a malicious file, malware could then be injected into their system.

Another variation on this theme would be a phishing email asking the victim to confirm their identity by entering personal data; threat actors could then use this data to directly access corporate resources within the security context of the victim or to perform a password reset of the victim’s corporate account.

It’s also worth mentioning that the infrastructure utilised by companies within the energy sector is often complex, and geographically diverse, presenting a large attack surface area that can be difficult to secure. Their networks also often contain a mixture of both cyber and physical infrastructure such as supervisory control and data acquisition (SCADA) systems, which were not designed with internet connectivity in mind. SCADA systems are a type of operational technology (OT) that can be used to control and monitor the physical processes, devices, and infrastructure involved in energy production and distribution. These systems have often been upgraded to enable internet access, or have had their interfaces exposed via the web in ways that were not initially expected when the system was initially deployed. As a result of this, these systems may lack the necessary security controls to protect against cyber-attacks.

Stuxnet and Pipedream: a nation-state attack case study

Stuxnet was a malicious computer worm that was first identified in 2010 and was considered to be one of the most sophisticated pieces of malware ever created. Stuxnet was developed using several advanced techniques and was able to spread rapidly through networks, going undetected by traditional antivirus software.

It is widely believed that Stuxnet was designed by a nation-state to disrupt Iran's nuclear programme, designed to target industrial control systems (ICS), more specifically the centrifuges used to enrich uranium in nuclear facilities in Iran. The Stuxnet worm was able to attack these systems, causing physical damage to the centrifuges themselves. This attack first targeted companies that were involved in some way with the ICS used within the Natanz nuclear facility in Iran. These companies were chosen as they had physical access to the Natanz facility as the ICS held within were air-gapped.

The Stuxnet worm typically spread via infected USB flash drives which was the initial vector employed to infect employees of the third-party companies. The Stuxnet worm then infected the ICS within the Natanz nuclear facility when the third-party contractors physically visited the site. Stuxnet has been described as a game-changer in the world of cyber warfare. It demonstrated the potential for cyber-attacks to cause physical damage to critical infrastructure and raised concerns about the vulnerability of ICS. The discovery of Stuxnet led to increased attention and investment in cybersecurity for critical infrastructure around the world.

Since Stuxnet, cyber threat actors began to focus more on malware designed to target ICS. In 2021, a modular ICS-specific malware known as Pipedream was identified. Pipedream is multi-stage malware that is designed to infiltrate a system, gain persistence, and then execute commands on behalf of the threat actor. The initial vector for distributing Pipedream was via phishing emails that contained a malicious attachment, which if opened by the victim would download additional components and establish a persistent connection to the threat actor's command and control infrastructure, granting the threat actor the ability to remotely control the infected system and execute commands.

How leaders in the energy sector can shore up their defences

With threat actors now actively developing tools that specifically target infrastructure such as ICS, the requirement for organisations within the energy sector to invest in cybersecurity to ensure that they are equipped with the necessary tools, skills, and expertise to identify and protect against cyber-attacks is critical.

Key areas for the industry to focus on include:

• 1. Security awareness training – Training and educating employees about common attack vectors used by threat actors, such as phishing/spear phishing, along with cybersecurity best practices, comprising technical and process-based controls, why they are necessary, and how they can help to mitigate against cyber threats.
• 2. Strong access controls – Implementing strong access controls, such as multi-factor authentication (MFA) and privileged access management, can help prevent unauthorised access to critical systems.
• 3. Regular security assessments – Performing regular vulnerability scanning, penetration testing, and cyber-attack simulations can help to identify weaknesses and gaps in the security infrastructure and process-based controls, and facilitate remediation.
• 4. Business continuity and incident response planning – Developing, implementing, and regularly testing a business continuity and incident response plan can enable a faster recovery time and help to minimise the impact and damage caused by a cyber-attack.
• 5. Security monitoring and alerting – Implement and maintain a security monitoring and alerting solution configured to alert upon activities and events falling outside of a known baseline.

Final thoughts

To conclude, the energy sector is at risk of cyber-attacks from a variety of different threat actors, each with its own motivations and methods. The consequences of a successful cyber-attack could have severe fallout for the industry and wider economy. The energy sector needs to invest in cybersecurity to educate employees, increase technical security controls, and become better prepared to both protect against and recover from cyber-attacks.

Written by Matt Watson, Red Team Expert at CovertSwarm, a leading global ethical hacking, and cyber security solution provider.

 

Read the latest issue of World Pipelines magazine for pipeline news, project stories, industry insight and technical articles.

World Pipelines’ May 2023 issue

The May 2023 issue of World Pipelines includes a special section on pipeline design and operation in extreme environments. Also featured are technical articles on field joint coatings, pipeline steels, and safety and risk management for pipeline networks.

Read the article online at: https://www.worldpipelines.com/special-reports/19052023/threat-of-nation-state-attacks-is-growing/