By Gregory Hale
Colonial Pipeline suffered a DarkSide ransomware attack this past May, and it cost the company $4.4 million when they were forced to shut down operations. The same month, ransomware group REvil breached the computer networks of JBS Foods, shutting down some operations of one of the largest beef suppliers in the world. The company paid the $11 million ransom.
“In terms of ransomware attacks, a significant number of cases go unreported; a lot of ransomware attacks that happen don’t make the news,” said Robert M. Lee, chief executive and co-founder of security provider Dragos during a press conference on the company’s ICS/OT Cybersecurity Year in Review 2021 report. “You might focus on the Colonial and JBS attacks, but there is a lot more happening. We are seeing attacks very heavily focused on manufacturing. I think there is a decrease in people reporting cases to the government.”
There are reasons why manufacturing remains a victim of attacks.
For mature clients that seek information and have a certain level of security maturity already, 86 percent of those firms had limited visibility into their environments, Lee said. In addition, 77 percent had poor security perimeters and 70 percent had external connections to the OT environment. On top of that the report showed 44 percent of the companies shared IT and OT credentials.
With those issues, it wouldn’t take much for an attacker to get in and wreak havoc.
Ransomware Leads Attacks
Over the past year, cyber risk to industrial sectors grew and accelerated, largely led by ransomware.
In its year in review, Dragos emphasized the importance of understanding how adversaries gain access and steal information to better prepare for threats in the future. Adversaries tend to build their operations and capabilities methodically over time; their previous efforts often determine their future success.
Dragos compiled data on these ransomware sectors: Manufacturing accounted for 65 percent, with Food & Beverage coming in second (11 percent), and Transportation third (8 percent). When analyzing manufacturing subsectors, Dragos found Metal Components (17 percent), Automotive (8 percent), and Technology (6 percent) were the most common.
Two ransomware groups, Conti and Lockbit 2.0, caused 51 percent of the total ransomware attacks, with 70 percent of their malicious activity targeting manufacturing. Conti dates to 2020, with confirmed attacks targeting CS Energy and Shutterfly. In June of 2021, Lockbit 2.0 retooled and now focuses on stealing data and extorting victims for financial gain by threatening publication of exfiltrated data if victims do not pay the ransom.
In 2021, Lockbit 2.0 claimed to possess the data of energy equipment supplier Schneider Electric, according to a post on Lockbit 2.0’s dark web forum. The compromise was never confirmed, and the posted Schneider Electric data appears to have come from a previous attack on Vestas, a Danish wind turbine manufacturer, according to the report.
Source: Dragos
RaaS Availability Growing
This spike in ransomware attacks can be attributed to the ransomware-as-a-service (RaaS) phenomena, according to the report. However, another key factor is the digital transformation of the industrial sectors and the increased connectivity between IT and OT. Ransomware gangs like Conti and Lockbit 2.0 have mobilized an underground marketplace where their developers outsource operations to affiliates who execute the attacks. Affiliates do not require high-level technical expertise because the ransomware software has been developed and they can purchase access to systems and hackers for hire, which significantly lowers barriers to entry.
With ransomware actors having fewer barriers to entry the financial impacts are becoming higher for the industrial sectors, according to the report. Typically, ransomware groups threaten to release exfiltrated corporate and personal information before encrypting the target filesystems, then dump the information on dark web leak sites. During the first half of 2021, the average remediation costs of ransomware attacks against ICS sectors continued to rise from downtime, staffing, disruption to device and network operations, lost business opportunities, and paid ransoms.
DarkSide (now rebranded as REvil) offered customer service with real-time chat support and brought in at least $60 million before it announced it was closing its operations. Investing in their business, ransomware gangs are funding research and development, which is fueling their industry as their extortion methods become more extreme.
Strains Blend
Ransomware trends are likely to continue shifting as groups reform, reprioritize, and law enforcement pursues them and takes them offline. As groups disband and reform, there is a blending of ransomware strains, and a greater likelihood that more strains with ICS/OT capabilities will be developed in 2022.
Lee said ransomware is a huge issue, but agrees supply chain attack pose potential problems moving forward.
“Ransomware is most impactful on shareholders and business risk,” Lee said. “Rarely is ransomware going to become a national security event. When you talk about supply chain, that is where you can significantly have far reaching impact.”
Click here for more on the Dragos report.