Plan ahead High Monitor
Report profiles Russian GRU hackers linked to industrial attacks
Il Sole 24 ORE (via Google News)
What happened. Il Sole 24 ORE asks who the Russian GRU hackers behind attacks on industrial systems are, naming the group Z-Pentest. The report gives no further detail on targets or methods.
Who is affected. The source does not say which organisations are affected.
What to do. Review remote access and exposure of control systems at your sites, and brief your team on the reported group.
When to act. Plan ahead: Industrial operators: a reported GRU-linked campaign against industrial systems; check remote access and control…
Editor's reading
ForOT security leaddetection engineerleadership
- Purdue level
- L3.5
- L2
Why: The report reports attacks on industrial systems without naming components. HMIs (L2) and remote-access paths (L3.5) are the usual routes in.
- Are you exposed?
Check whether HMIs, SCADA servers or remote-access gateways at your sites are reachable from the internet.
- If you cannot fix it yet
- Restrict remote access to control systems to known users and require multi-factor authentication.
- Take HMIs and other control interfaces off the internet.
- Watch for
- Logons to HMIs or SCADA hosts from unfamiliar sources or the IT network.
- New remote-access tools or unexpected remote sessions on plant systems.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Il Sole 24 ORE (via Google News) (opens news.google.com)