Shifts in threat landscape to industrial control systems

Issue 8 2022 Information Security

Kaspersky’s ICS CERT researchers shared their predictions for the next years’ industrial control system-focused developments and risks that organisations should prepare for in 2023. These predictions include increased attack surface due to digitisation, activities of volunteer and cybercriminal insiders, ransomware attacks on critical infrastructure as well as the technical, economic and geopolitical effects on the quality of threat detection and the rise of potential vulnerabilities being exploited by attackers.

These predictions are the sum of the opinions of Kaspersky’s ICS CERT team based on their collective experience in researching vulnerabilities, attacks, and incident response, as well as the experts’ personal vision of the main vectors driving changes in the threat landscape.

New risks and changes in threat landscape

Kaspersky experts predict a shift in advanced persistent threat (APT) activity against industrial organisations and OT systems in new industries and locations. The real economy sectors such as agriculture, logistics and transport, the alternative energy sector and the energy sector as a whole, high-tech, pharmaceuticals and medical equipment producers are likely to see more attacks next year. Moreover, traditional targets, such as the military industrial complex, and the government sector will also remain.

Attack surface will also increase due to digitisation, in a race for higher efficiency in IoT, including systems for predictive maintenance and digital twin technology. This trend is supported by the statistics of attacks on Computerised Maintenance Management Systems (CMMS) in the first half of 2022. In the META region (Middle East, Turkey, Africa), 39,3% of CMMS were attacked in the first half of 2022, where in Africa, 40% of CMMS were attacked during the same period.

The risks of expanding attack surface are also connected to the rising energy carrier prices and the resulting rises in hardware prices and would force many enterprises to abandon plans to deploy on- premise infrastructure, in favour of cloud services from third party vendors, and may also affect some IS budgets.

Threats may also come from unmanned transportation means and aggregates that can be either targets or tools for attacks. Other risks to watch out for are the heightened criminal activity with a goal to harvest user credentials as well as more volunteer ideological and politically motivated insiders, and insiders working with criminal groups, usually extortionists and APTs. These insiders may be active in productions facilities, as well as technology developers, product vendors and service providers.

The geopolitical ebb and flow of trusted partnerships, which have a global effect on the state of cybersecurity in ICS too, will be more evident in 2023. Besides the growth of hacktivist activity “working” to internal and external political agendas, which may become more effective, we might also see more ransomware attacks on critical infrastructure due to the fact that it will become harder to prosecute such attacks.

Deterioration of international law enforcement cooperation will lead to an influx of cyberattacks in the countries considered adversaries. At the same time, new alternative solutions developed domestically may also lead to new risks such as the software containing security configuration errors and easy zero-day vulnerabilities, making them accessible to both cybercriminals and hacktivists.

Organisations may face new risks such as a decrease in quality threat detection due to communication breakdowns between information security developers and researchers located in countries currently in conflict. We may also face a decreasing quality of threat intelligence leading to unsupported attribution and government attempts to control information about incidents, threats and vulnerabilities. The growing role of governments in the operational processes of industrial enterprises, including connections to government clouds and services, which would sometimes be less protected than the market-leading private ones, also leads to additional IS risks. Thus, there is an increased risk of confidential data leaks due to the noticeable number of under-qualified employees in government institutions as well as a still developing internal culture and practices for responsible disclosure.

New techniques and tactics to watch out for in future attacks

Kaspersky ICS CERT researchers also listed top techniques and tactics expected to flourish in 2023:

• Phishing pages and scripts embedded on legitimate sites.

• The use of broken distributives with Trojans packed inside, patches and key generators for commonly used and specialist software.

• Phishing emails about current events with especially dramatic subjects, including political events.

• Documents stolen in previous attacks on related or collaborate organisations used as bait in phishing emails.

• The spread of phishing emails from compromised employees and partners’ email boxes disguised as legitimate work correspondence.

• N-day vulnerabilities – these will be closed even more slowly as security updates for some solutions become less accessible in some markets.

• Abusing basic default configuration errors (such as using default passwords) and easy zero-day vulnerabilities in products from ‘new’ vendors, including local ones.

• Attacks on cloud services.

• Using configuration errors in security solutions, for instance, the ones allowing disabling of an antivirus solution.

• Using popular cloud service as CnC – even after an attack is identified, the victim might still be unable to block the attacks because important business processes could depend on the cloud.

• Exploiting vulnerabilities in legitimate software, DLL Hijacking and BYOVD (Bring Your Own Vulnerable Driver), for instance, to bypass end node security.

• The spread of malware via removable media to overcome air gaps.

“We saw that cybersecurity incidents were plentiful in 2022 causing many problems for ICS owners and operators. However, we did not see any sudden or catastrophic changes in the overall threat landscape, none that was difficult to handle, despite many colourful headlines in the media. As we analyse incidents of 2022, we must profess that we have entered an era where the most significant changes in the ICS threat landscape are mostly determined by geopolitical trends and the subsequent macroeconomic factors. Cybercriminals are naturally cosmopolitan; however, they do pay close attention to political and economic trends as they chase easy profits and ensure their personal safety. We hope that our analysis of future attacks will prove helpful to organisations to prepare for new and emerging threats,” commented Evgeny Goncharov, head of Kaspersky’s ICS CERT.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Highest increase in global cyberattacks in two years
Information Security News & Events
Check Point Global Research released new data on Q2 2024 cyber-attack trends, noting a 30% global increase in Q2 2024, with Africa experiencing the highest average weekly per organisation.

Read more...
Upgrade your PCs to improve security
Information Security Infrastructure
Truly secure technology today must be designed to detect and address unusual activity as it happens, wherever it happens, right down to the BIOS and silicon levels.

Read more...
Open source code can also be open risk
Information Security Infrastructure
Software development has changed significantly over the years, and today, open-source code increasingly forms the foundation of modern applications, with surveys indicating that 60 – 90% of the average application's code base consists of open-source components.

Read more...
DeepSneak deception
Information Security News & Events
Kaspersky Global Research & Analysis researchers have discovered a new malicious campaign which is distributing a Trojan through a fake DeepSeek-R1 Large Language Model (LLM) app for PCs.

Read more...
SA’s strained, loadshedding-prone grid faces cyberthreats
Power Management Information Security
South Africa’s energy sector, already battered by decades of underinvestment and loadshedding, faces another escalating crisis; a wave of cyberthreats that could turn disruptions into catastrophic failures. Attacks are already happening internationally.

Read more...
Almost 50% of companies choose to pay the ransom
News & Events Information Security
This year’s Sophos State of Ransomware 2025 report found that nearly 50% of companies paid the ransom to get their data back, the second-highest rate of ransom payment for ransom demands in six years.

Read more...
Survey highlights cost of cyberdamage to industrial companies
Kaspersky Information Security News & Events
The majority of industrial organisations estimate their financial losses caused by cyberattacks to be over $1 million, while almost one in four report losses exceeding $5 million, and for some, it surpasses $10 million.

Read more...
Digital economy needs an agile approach to cybersecurity
Information Security News & Events
South Africa is the most targeted country in Africa when it comes to infostealer and ransomware attacks. Being at the forefront of the continent’s digital transformation puts South Africa in the crosshairs for sophisticated cyberattacks

Read more...
SIEM rule threat coverage validation
Information Security News & Events
New AI-detection engineering assistant from Cymulate automates SIEM rule validation for SecOps and blue teams by streamlining threat detection engineering with automated testing, control integrations and enhanced detections.

Read more...
Cybersecurity a challenge in digitalising OT
Kaspersky Information Security Industrial (Industry)
According to a study by Kaspersky and VDC Research on securing operational technology environments, the primary risks are inadequate security measures, insufficient resources allocated to OT cybersecurity, challenges surrounding regulatory compliance, and the complexities of IT/OT integration.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.