CISA issued a Binding Operational Directive (BOD 23-01) requiring federal civilian executive branch agencies to change their asset discovery, vulnerability detection, and reporting practices, with requirements in place by April 3, 2023, and progress...
Dragos held its second annual DISC Capture the Flag event on November 5, 2022, drawing 597 registered players across 385 teams to 42 ICS/OT-focused challenges built around a story inspired by Pipedream and the CHERNOVITE threat group. The winning team,...
Dragos announced its 2022 ICS/OT Cybersecurity Year in Review, a look back at the prior year's cyber events plus forward analysis of the industrial control systems and operational technology threat landscape. The report covers threat groups targeting...
Dragos OT-CERT's monthly SMB guidance states that the easiest path for intruders and malware into an OT network is through ICS/OT assets exposed directly to the internet, and that direct internet connections from OT are a common finding in its risk...
Dragos tracked 57 ransomware groups that have hit industrial organizations, of which 24 were active in Q4 2022, and recorded 189 ransomware incidents against industrial organizations and infrastructure - a 30 percent increase over the prior quarter's 128....
Dragos announced on February 1, 2023 that it appointed Kurt Gaudette, who brings more than 30 years of operational and technical intelligence experience, as Vice President of Global Threat Intelligence. Gaudette previously served in the U.S. Department of...
Dragos released Knowledge Pack KP-2023-001 for Platform 2.x customers, containing over 280 characterizations and 540 detections, after assessing newly disclosed vulnerabilities in more than 900 products from vendors including Mitsubishi Electric, Siemens,...
Dragos compiled a list of its top ICS/OT cybersecurity blogs from 2022, covering topics including the 2021 ICS/OT Cybersecurity Year in Review, network segmentation for flat ICS/OT networks, and the PIPEDREAM modular ICS attack framework, which the post...
Dragos added a "Trend Insights" tab to the main page of its Neighborhood Keeper portal, consolidating trending detections and indicators of compromise with their percentage change into a single view with stacked panels for 7, 30, and 180 days. The blog...
Dragos released its sixth annual ICS/OT Cybersecurity Year in Review, reporting 605 ransomware attacks against industrial organizations in 2022, an 87 percent increase over the prior year, with manufacturing taking 72 percent of them. The report also...
Dragos OT-CERT's monthly best-practices blog for under-resourced organizations addresses how vendors should access and transfer files to an OT network when they come onsite, offering two separate practices - one for network access and one for file...
The EU's NIS2 Directive, released at the start of 2023, replaces the 2016 NIS Directive and identifies Operators of Essential Services by size rather than leaving that choice to member states, with non-compliance risking fines up to €10 million or 2...
Dragos relaunched its Dragos Academy training program on a new Learning Management System with a cleaner interface for viewing course schedules and registering for live and on-demand classes. The company added six new on-demand courses, including the...
Dragos reports a rising trend in offensive tooling that uses the Telegram and Discord APIs as command-and-control channels, with traffic flowing to endpoints such as https://telegram.org/api and https://discord.com/api. Many of these toolkits first perform...
Dragos released Knowledge Pack KP-2023-002 for customers on Dragos Platform 2.x, covering newly disclosed vulnerabilities in over 800 products from vendors including Siemens, Mitsubishi Electric, Weidmueller, SAUTER Controls, and Baicells. The pack adds...
The White House released its National Cybersecurity Strategy on March 2, 2023, calling for expanded minimum cybersecurity requirements in critical sectors, and the EPA followed the next day with a memorandum requiring states to audit the cybersecurity...
A Dragos OT-CERT blog post advises small and medium businesses to prepare alternate communication channels in advance, because a ransomware attack or physical incident could render email and chat unusable, or an adversary could listen in after breaching...
LockBit ransomware attacks rose sharply after 2021 and continued through 2022 against organizations tied to critical infrastructure and its supply chain, with manufacturing, electric, transportation, and logistics among the affected sectors. Per Dragos's...
The U.S. Transportation Security Administration issued four new cybersecurity requirements for airports and aircraft operators on an emergency basis, following the Biden administration's National Cybersecurity Strategy announced March 2, 2023. The...
Wind power supplied 26.8 percent of UK electricity generation in 2022, up from 1.5 percent in 2008, with Germany at 23 percent and Spain at 32 percent, and remote access used to monitor and control turbines has widened the attack surface. In 2022 there...
Dragos adversary hunters tracked 20 ICS/OT threat groups in 2022, up from five in 2017, and in April 2022 Dragos and a partner announced the discovery of PIPEDREAM, a cross-industry ICS attack framework built by the threat group CHERNOVITE and the seventh...
Dragos reviewed alleged contracts between Russian company NTC Vulkan and the Russian Ministry of Defense, later highlighted in a Washington Post article and now called the Vulkan files, which describe measures to monitor and manipulate internet...
Dragos marked the first anniversary of OT-CERT, its free cybersecurity resource for industrial asset owners, reporting more than 900 members from over 50 countries since launching at RSA Conference 2022. The program offers guides, templates, videos,...
Dragos tracked 214 ransomware incidents against industrial organizations in Q1 2023, a 13 percent increase from the prior quarter, with 20 of the 61 groups it follows causing significant damage. The Clop group claimed the GoAnywhere zero-day...
Dragos published the third post in its Neighborhood Keeper series, focused on long tail analysis - identifying low-occurrence events that fall outside the core of routine network behavior to surface activity worth investigating. The post describes using...
The ISA/IEC 62443 series specifies security requirements for industrial automation and control systems (IACS), developed and published by the International Society of Automation's ISA99 Committee and IEC Technical Committee 65/Working Group 10. The...
Dragos released further analysis and runtime testing results on MOUSEHOLE, the OPC UA client module within PIPEDREAM, the seventh known ICS-specific malware, developed by the CHERNOVITE threat group and first covered by Dragos in an April 2022 whitepaper...
The Cybersecurity Maturity Model Certification (CMMC) is a U.S. Department of Defense framework requiring companies in the DoD supply chain to hold adequate cybersecurity controls, assessed across three levels under CMMC 2.0, down from five. Compliance...
On May 8, 2023, a known cybercriminal group attempted and failed an extortion scheme against Dragos, gaining access by compromising the personal email of a new sales employee before their start date and using that information to impersonate the employee...
Manufacturers are adopting AI for predictive maintenance, quality control, inventory management, supply chain management and autonomous robots, and Dragos notes that the AI model is usually cloud-hosted, requiring external network connections from the...