Cybersecurity

U.S. warned of exploit in Ukrainian cyberattacks

Shutterstock image (by gyn9037): High voltage towers, electricity infrastructure.

A new report from Kaspersky Lab about the coordinated cyberattack over the Christmas holidays that took out sections of the Ukrainian power grid says the exploit might have appeared in the U.S. two years ago.

Cybersecurity experts say the offensive was the first cyberattack to take out a power grid.

The ability to turn a critical infrastructure cyberattack into a physical assault is among the biggest fears of security officials worldwide. Not surprisingly, cybersecurity protections for the energy grid are a top priority in the comprehensive energy bill -- the first in five years -- making its way through the Senate.

According to a Jan. 28 report by Kaspersky Lab's Global Research and Analysis Team, the attack on the Ukrainian power grid used email phishing and malware that harnessed Microsoft Word document attachments to infiltrate industrial control systems.

Kaspersky and other cybersecurity experts have said the Russia-linked BlackEnergy APT group is behind the attack.

The U.S. Industrial Control Systems Cyber Emergency Response Team warned in 2014 about BlackEnergy's use of Word and other Microsoft Office documents in a targeted campaign to infiltrate computer facilities at a U.S. academic institution, Western European governments, and energy and telecommunications companies.

ICS-CERT said BlackEnergy had successfully broken into numerous industrial control systems at U.S. electrical and water companies by exploiting Microsoft Windows and Word.

According to Kaspersky's report, the attacks in the Ukraine, which has been a favorite BlackEnergy target, showed a shift from Excel to Word attachments to spread the malware. That shift could mean the group has tweaked the malware to make it a more potent threat to the critical infrastructure sector.

"Interestingly, the use of Word documents (instead of Excel) was also mentioned by ICS-CERT, in their alert," the report states.

Another advanced persistent threat actor, called Turla, has begun using Word documents to drop malicious payloads, according to Kaspersky. "This leads us to believe that many of these attacks are successful and their popularity will increase," the report states.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, tele.com magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at mrockwell@fcw.com or follow him on Twitter at @MRockwell4.


Featured

  • IT Modernization
    Eisenhower Executive Office Building (Image: Wikimedia Commons)

    OMB's user guide to the MGT Act

    The Office of Management and Budget is working on a rules-of-the-road document to cover how agencies can seek and use funds under the MGT Act.

  • global network (Pushish Images/Shutterstock.com)

    As others see us -- a few surprises

    A recent dinner with civil servants from Asia delivered some interesting insights, Steve Kelman writes.

  • FCW Perspectives
    cloud (Singkham/Shutterstock.com)

    A smarter approach to cloud

    Advances in cloud technology are shifting the focus toward choosing the right tool for the job and crafting solutions that truly modernize systems.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.