Dragos published a summarized version of its whitepaper on consequence-driven ICS cybersecurity scoping, arguing that as IT integrates into ICS environments the expanded attack surface lets attackers cause disruption, citing TRISIS as the first malware...
CrowdStrike's Kris Krewson and Dragos' Lesley Carhart describe consulting in industrial environments where IT cybersecurity and OT teams are often segregated with little interaction, and where OT staff may have built their own disaster recovery plans...
Dragos recounts a continual rise in sophisticated cyber attacks on electric infrastructure, citing Ukraine's December 2015 attack that left over 225,000 customers without power for up to 6 hours until manual restoration, and CRASHOVERRIDE in December 2016,...
McAfee researcher Douglas McKee disclosed a buffer overflow in Delta Controls' eBMGR, a combined BACnet gateway and controllable building controller running embedded Linux, where a BVLC header length field larger than the 1476-byte standard is not...
A Dragos Threat Operations Center analyst describes ICS Purple Teaming as a grey-box, collaborative assessment between Red and Blue Teams rather than a black-box adversarial test, with the ICS Blue Team including the site Operations, Engineering and IT...
In the second part of a three-part series on ICS purple teaming, Dragos describes how assessments of operating ICS networks differ from IT assessments because safety and reliability take precedence, with many sites barring any packets on Purdue Level 1 or...
This final part of Dragos's three-part ICS purple teaming series describes how a purple team assessment is run: constant, transparent communication with operations reduces the risk of operational disturbance and limits blame for unrelated site outages,...
NIST's National Cybersecurity Center of Excellence released draft practice guide SP 1800-23, Energy Sector Asset Management, developed with Dragos and vendors including Forescout, FoxGuard Solutions, KORE Wireless Group, Splunk, TDi Technologies, and...
Dragos contributed an ICS dataset drawn from a real brewery control system to Splunk's Boss of the SOC capture-the-flag competition, which begins at Splunk.conf19 on October 21, 2019 in Las Vegas. BOTS, first run in 2016, is a blue-team jeopardy-style CTF...
On October 20, 2019, a Twitter account claimed a fire at Iran's Abadan Oil Refinery was a confirmed cyber attack, while Reuters, citing Iranian state broadcaster IRIB, reported the fire was in a waste canal and under control. Dragos assessed that claims of...
NPCIL confirmed on October 30, 2019 a malware infection at the Kudankulam Nuclear Power Plant in Tamil Nadu, on a computer NPCIL said was on the administrative network isolated from the critical internal network, after CERT-In alerted officials on...
Dragos argues that the 'IT versus OT' debate, including the position its own Ben Miller took at S4x18, sets up a false choice, because IT-OT convergence means IT-centric attack paths are becoming OT problems. The post cites CRASHOVERRIDE, which blended IT...
A Dragos blog post uses Jurassic Park as a teaching case for ICS security, noting that Isla Nublar's systems had to run fully independently for power, distribution, and water, and that the dinosaurs' escape traced back primarily to a loss of power rather...
MITRE announced ICS-ATT&CK, a framework organizing the malicious threat behaviors affecting industrial control systems, with Dragos' ICS intelligence team contributing to categorize and validate public threat behaviors. The framework defines 11 behavioral...
Dragos released The North American Electric Cyber Threat Perspective, based on its ICS-specific threat intelligence, global platform telemetry, and service engagements. The report states that two groups, MAGNALLIUM and XENOTIME, expanded their targeting...
EKANS ransomware emerged in mid-December 2019 and was first identified in a commercial virus repository on 26 December 2019; written in Go, it force-stops a hard-coded list of 64 processes, including GE Proficy historian, GE Fanuc licensing services, and...
Dragos revisited two incidents where analysts leaned heavily on malware analysis and their initial assessments, concluding that examining a sample alone strips away context about its origin and purpose. The cases were the 2016 Ukraine power event, first...
CISA reported on 18 February 2020 that ransomware hit a natural gas compression facility at an unidentified U.S. pipeline operator, causing loss of view and control in both IT and ICS assets, a controlled shutdown, and two days of downtime. Dragos...
Dragos assessed 438 ICS vulnerabilities in 2019, reported by independent researchers, vendors, and ICS-CERT, and identified three new activity groups targeting ICS entities globally, bringing its total count to 11. The report concludes that threats to...
ENTSO-E, which represents 42 electric Transmission System Operators across 35 countries, confirmed on 09 March 2020 that an adversary compromised its office network, though the organization said that network is not connected to any operational TSO system....
A Dragos blog summarizing Joe Slowik's whitepaper revisits LockerGoga, the ransomware that hit Norsk Hydro on 19 March 2019, encrypting all files outside Program Files and OS directories and forcing the company to run impacted industrial systems in manual...
Dragos notes that OT systems were retrofitted with remote monitoring and access to cut the cost and coordination burden of on-site support, and that many organizations learned in the early 2000s that cybersecurity had to be built in rather than bolted on....
Dragos Director of Intelligence Analysis Amy Bejtlich and Cyber Threat Intelligence Analyst Selena Larson presented an OSINT primer at RSAC in San Francisco on 26 February 2020, describing the types of public information an adversary may target to develop...
Dragos is now shipping its Knowledge Packs, previously called Content Packs, on a monthly cadence rather than a slower schedule. The packs are not software upgrades to the Dragos Platform but separate deliveries of industrial adversarial information,...
Dragos describes living off the land as adversary use of pre-existing, legitimate capabilities on a victim host and network, a technique most professionals associate with IT but which also works in OT through abuse of native HMI functionality and...
Dragos publicly announced Neighborhood Watch, an integrated managed threat hunting program for industrial infrastructure organizations, after delivering and refining it for two years with customers across its core industries. The program was built to...
Dragos released Platform v1.6, which the company describes as the first ICS/OT cybersecurity vendor to incorporate MITRE ATT&CK for ICS into its technology, mapping threat detections to the framework's tactics and techniques. The release expands asset...
Dragos reported five security defects in Schneider Electric's Triconex Safety Instrumented System, two of them in the Ethernet-based Tricon Communication Module (TCM): CVE-2020-7486, a denial of service that can put the TCM into a fault state, and...
Dragos reports that EKANS ransomware, first publicly disclosed on 06 January 2020 by Vitali Kremez and MalwareHuntTeam, has been traced to at least attempted intrusions against high-profile organizations since 2020. Dragos assesses with high confidence...
Dragos co-hosted a SANS webinar on June 2 with CTO Jon Lavender and VP Ben Miller to detail and demo Dragos Platform version 1.6, which adds asset inventory and identification capabilities and incorporates the MITRE ATT&CK for ICS Framework into its...