Pierluigi Paganini
May 26, 2023
Researchers from Mandiant discovered a new malware, named CosmicEnergy, designed to target operational technology (OT) / industrial control system (ICS) systems. The malicious code was first uploaded to a public malware scanning service in December 2021 by a user in Russia. The malware is specifically designed to disrupt electric power by interacting with IEC 60870-5-104 (IEC-104) devices, such as remote terminal units (RTUs). These RTU are widely adopted n electric transmission and distribution operations in Europe, the Middle East, and Asia.
COSMICENERGY is one of the OT malware that were spotted over the years, but according to Mandiant, what makes this malware unique is that it has been developed by a contractor as part of a red teaming activity for simulated power disruption exercises hosted by Rostelecom-Solar, a Russian cyber security company. The ICS malware supports capabilities that are comparable to those implemented in malware such as INDUSTROYER and INDUSTROYER2.
Both INDUSTROYER and INDUSTROYER2 malware strains were used by Russia-linked APT groups in attacks aimed at critical infrastructure in Ukraine targeting IEC-104.
“COSMICENERGY’s capabilities and overall attack strategy appear reminiscent of the 2016 INDUSTROYER incident, which issued IEC-104 ON/OFF commands to interact with RTUs and, according to one analysis, may have made use of an MSSQL server as a conduit system to access OT.” reads the analysis published by Mandiant. “Leveraging this access, an attacker can send remote commands to affect the actuation of power line switches and circuit breakers to cause power disruption.”
COSMICENERGY is composed of two components, respectively tracked as PIEHOP and LIGHTWORK:
The researchers pointed out that the malware doesn’t support discovery capabilities, which implies that the operator would need to perform some internal reconnaissance to obtain environmental information (i.e. MSSQL server IP addresses, MSSQL credentials, and target IEC-104 device IP addresses).
The analysis of COSMICENERGY revealed the use of a module associated with a project named “Solar Polygon.” Searching for this unique string, the researchers identified a single match to a cyber range (aka polygon) developed by Rostelecom-Solar.
“The discovery of COSMICENERGY illustrates that the barriers to entry for developing offensive OT capabilities are lowering as actors leverage knowledge from prior attacks to develop new malware. Given that threat actors use red team tools and public exploitation frameworks for targeted threat activity in the wild, we believe COSMICENERGY poses a plausible threat to affected electric grid assets.” concludes the report. “OT asset owners leveraging IEC-104 compliant devices should take action to preempt potential in the wild deployment of COSMICENERGY. “
We are in the final!
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini
Please nominate Security Affairs as your favorite blog.
Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, ICS malware)
