Dragos Industrial Ransomware Attack Analysis: Q1 2023
Summary: Dragos tracked 214 ransomware incidents against industrial organizations in Q1 2023, a 13 percent increase from the prior quarter, with 20 of the 61 groups it follows causing significant damage. The Clop group claimed the GoAnywhere zero-day (CVE-2023-0669) to impact 130 organizations in February 2023, while Cuba and Play used the OWASSRF exploit against unpatched Microsoft Exchange servers in January 2023.
Bottom line: Manufacturing absorbed 67 percent of the quarter's attacks (143 incidents), and incidents like Copper Mountain Mining's isolation of its ICS/OT network and Dole's plant shutdowns show ransomware now forcing manual operations and production stops. Dragos assesses with moderate confidence that as ransom revenues fall, groups will increase efforts to cause damage to industrial organizations to meet financial objectives.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2022-41080CVE-2023-0669
- Related
- CVE-2023-0669: Fortra GoAnywhere MFT Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2023CVE-2022-41080: Microsoft Exchange Server Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Jan 10, 2023