These attacks use minimally secured, Internet-facing virtual network computing (VNC) connections to infiltrate, or gain access to, OT control devices within critical infrastructure systems.
These pro-Russia hacktivist groups are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include water and wastewater systems, food and agriculture, and energy.
Pro-Russia hacktivist groups employ easily disseminated and replicated tactics, techniques and procedures (TTPs) across various entities, increasing the likelihood of widespread adoption and escalating the frequency of intrusions, according to a joint cybersecurity advisory by the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation, the National Security Agency, Department of Energy, Environmental Protection Agency, the Department of Defense Cyber Crime Center, and multiple other international partners, entitled “Pro-Russia Hacktivists Create Opportunistic Attacks Against US and Global Critical Infrastructure.”
Haphazard Attacks
In the end, these groups have limited capabilities, frequently misunderstanding the processes they aim to disrupt. Their apparent low level of technical knowledge results in haphazard attacks where actors intend to cause physical damage but cannot accurately anticipate actual impact.
Despite these limitations, the security agencies observed these groups willfully cause actual harm to vulnerable critical infrastructure.
Pro-Russia hacktivist groups use their TTPs to target virtual network computing (VNC)-connected HMI devices. These groups are primarily seeking notoriety with their actions.
While they have caused damage in some instances, they regularly make false or exaggerated claims about their attacks on critical infrastructure to garner more attention, according to the advisory.
They frequently misrepresent their capabilities and the impacts of their actions, portraying minor incursions as significant breaches, but such incursions can still lead to lost time and resources for operators remediating systems, the advisory said.
Additionally, pro-Russia hacktivists use an opportunistic targeting methodology. They leverage superficial criteria, such as victim availability and existing vulnerabilities, rather than focusing on strategically significant entities.
Their lack of strategic focus can lead to a broad array of targets, ranging from water treatment facilities to oil well systems.
Pro-Russia hacktivists have demonstrated a pattern of frequently taking advantage of the widespread availability of vulnerable VNC connections. While system owners typically use VNC connections for legitimate remote system access functions, threat actors can maliciously use these connections to broadly target numerous platforms and services, according to the advisory.
Furthermore, Pro-Russia hacktivist groups successfully targeted supervisory control and data acquisition (SCADA) networks using basic methods, and in some cases, performed simultaneous DDoS attacks against targeted networks to facilitate SCADA intrusions.
Unsophisticated TTPs
As recently as this past April, threat actors used the following unsophisticated TTPs to access networks and conduct SCADA intrusions:
- Scan for vulnerable devices on the Internet with open VNC ports
- Initiate temporary virtual private server (VPS) to execute password brute force software
- Use VNC software to access hosts
- Confirm connection to the vulnerable device
- Brute force the password, if required
- Gain access to HMI devices, typically with default, weak, or no passwords
- Log the confirmed vulnerable device IP address, port, and password
- Using the HMI graphical interface, capture screen recordings or intermittent screenshots while conducting the following actions, intending to affect productivity and cause additional costs:
–Modify usernames/passwords
–Modify parameters
–Modify device name
–Modify instrument settings
–Disable alarms
–Create loss of view (a technique that mandates local hands-on operator intervention)
–Device restart or shutdown - Disconnect from the device, ending the VNC connection
- Research the compromised device company after the intrusion
To reach a wider audience, these pro-Russia hacktivist groups work together, amplify each other’s posts, create additional groups to amplify their own posts, and likely share TTPs.
It is likely these and similar groups will continue to iterate and share these methods to disrupt critical infrastructure organizations.
OT owners and operators and critical infrastructure entities should take the following steps to reduce the risk of attacks through VNC connections:
- Reduce exposure of OT assets to the public-facing Internet
- Adopt mature asset management processes, including mapping data flows and access points
- Ensure OT assets are using robust authentication procedures
Click here for more on the joint cybersecurity advisory.