Since 2011 a group of attackers has been targeting companies that operate industrial control systems with a backdoor program called BlackEnergy.
“Multiple companies working with ICS-CERT have identified the malware on Internet-connected human-machine interfaces (HMIs),” the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), a division of the U.S. Department of Homeland Security, said in a security advisory Tuesday.
HMIs are software applications that provide a graphical user interface for monitoring and interacting with industrial machinery. They are a component of SCADA (supervisory control and data acquisition) systems that are used in industrial environments.
ICS-CERT has not identified cases where the BlackEnergy malware was used to damage, modify or disrupt the processes controlled by the compromised HMIs and it’s not clear if attackers used those HMIs to gain deeper access into the industrial control systems.
The organization believes the BlackEnergy attackers targeted deployments of HMI products from three different vendors: General Electric’s Cimplicity HMI, Siemens’ SIMATIC WinCC and BroadWin’s WebAccess—also distributed by Advantech.
Cimplicity HMI installations were compromised through a vulnerability that GE issued a patch for in December 2013. However, ICS-CERT believes this group of attackers has been exploiting the vulnerability since at least January 2012.
“ICS-CERT is concerned that any companies that have been running Cimplicity since 2012 with their HMI directly connected to the Internet could be infected with BlackEnergy malware,” because attackers likely used automated tools to discover and compromise vulnerable systems, the organization said.
ICS-CERT has not yet established the attack vectors for the SIMATIC WinCC and the Advantech/BroadWin WebAccess HMIs, but have reason to believe customers of these products have been targeted as well.
GE issued an alert about the BlackEnergy campaign on its security website. “We recommend customers who have GE CIMPLICITY products installed follow security practices and install the latest patches,” the company said. The alert includes a link to a support document accessible only to customers.
Siemens published an alert on its website too. “Siemens has been informed that a file discovered during the analysis of the BlackEnergy malware can be associated to the product SIMATIC WinCC,” the alert reads. “Experts from Siemens and ICS-CERT are investigating this issue and will provide information updates as soon as possible.”
Security researchers have predicted malware attacks against SCADA systems ever since the Stuxnet cybersabotage worm was discovered in 2010. Those predictions materialized this year: BlackEnergy is the second malware program found in the past several months that’s directly associated with attacks against industrial control systems.
BlackEnergy is the same malware that was used by a Russian cyberespioange group dubbed Sandworm to target organizations like the NATO alliance, energy firms and telecommunication companies. In an attack campaign exposed recently the group exploited a zero-day Windows vulnerability.
That Windows vulnerability, which was patched on Oct. 14, was not used to target industrial control system environments, ICS-CERT said. “However, analysis of the technical findings in the two reports shows linkages in the shared command and control infrastructure between the campaigns, suggesting both are part of a broader campaign by the same threat actor.”