Notorious Iranian Hacking Crew Is Targeting Industrial Control Systems
It has been reported that one of Iran's most active hacker groups appears to have shifted focus. Rather than just standard IT networks, they're targeting the physical control systems used in electric utilities, manufacturing, and oil refineries. At the CyberwarCon conference today, a Microsoft security researcher plans to present new findings that show this shift in the activity of the Iranian hacker group APT33, also known by the names Holmium, Refined Kitten, or Elfin.
Commenting on this, Sam Curry, chief security officer at Cybereason, said “Microsoft's research into APT33's recent targeting of industrial control systems reminds us that in the great cyber game, it’s about using peacetime to build “optionality”; amass assets, resources and access. The Iranian cyber forces are masters of this, and seeing increases in the cold war that is cyber conflict, it makes sense that they would continue to grow what’s worked in the past: expand penetration of weak networks with high access, produce tools for use in the ecosystem of cyber aggressors and build capacity.
Iran has been on the receiving end of such attacks, as with Stuxnet, and it’s been the attacker too, as with Saudi Aramco in 2012 this isn’t new, and it isn’t a passing fad. The great game of nations has a cyber extension now for new, less risky and ever-more powerful extensions of politics by other means – to paraphrase Clauswitz.
Subscribe to PII and receive:
Our long-established bi-monthly digital magazine *Process Industry Informer*, featuring exclusive articles, news and updates across the Process Industries, plus commentary from our three industry experts:
Sean Moran
Gavin Smith
Dave Green
PLUS:
- Process Industry Update — our weekly e-newsletter
- PII Podcast
- Special messages from our advertising partners
As early as 1992 with the alleged US attack on Siberian pipelines up to and including the Russian Black Energy attack in 2015 on Ukrainian power distribution companies or again the NotPetya attacks of 2017, there is a clear tradition of attacking critical infrastructure by cyber means. It should come as no surprise that nation states are looking to land, expand and grow their options. If you want to hamstring a country, drive trade concessions, win at the diplomacy table or amass power for strategic gains, cyber is the choice of the present and the foreseeable future.”
