Cybersecurity

U.S. warned of exploit in Ukrainian cyberattacks

Shutterstock image (by gyn9037): High voltage towers, electricity infrastructure.

A new report from Kaspersky Lab about the coordinated cyberattack over the Christmas holidays that took out sections of the Ukrainian power grid says the exploit might have appeared in the U.S. two years ago.

Cybersecurity experts say the offensive was the first cyberattack to take out a power grid.

The ability to turn a critical infrastructure cyberattack into a physical assault is among the biggest fears of security officials worldwide. Not surprisingly, cybersecurity protections for the energy grid are a top priority in the comprehensive energy bill -- the first in five years -- making its way through the Senate.

According to a Jan. 28 report by Kaspersky Lab's Global Research and Analysis Team, the attack on the Ukrainian power grid used email phishing and malware that harnessed Microsoft Word document attachments to infiltrate industrial control systems.

Kaspersky and other cybersecurity experts have said the Russia-linked BlackEnergy APT group is behind the attack.

The U.S. Industrial Control Systems Cyber Emergency Response Team warned in 2014 about BlackEnergy's use of Word and other Microsoft Office documents in a targeted campaign to infiltrate computer facilities at a U.S. academic institution, Western European governments, and energy and telecommunications companies.

ICS-CERT said BlackEnergy had successfully broken into numerous industrial control systems at U.S. electrical and water companies by exploiting Microsoft Windows and Word.

According to Kaspersky's report, the attacks in the Ukraine, which has been a favorite BlackEnergy target, showed a shift from Excel to Word attachments to spread the malware. That shift could mean the group has tweaked the malware to make it a more potent threat to the critical infrastructure sector.

"Interestingly, the use of Word documents (instead of Excel) was also mentioned by ICS-CERT, in their alert," the report states.

Another advanced persistent threat actor, called Turla, has begun using Word documents to drop malicious payloads, according to Kaspersky. "This leads us to believe that many of these attacks are successful and their popularity will increase," the report states.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, tele.com magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at mrockwell@fcw.com or follow him on Twitter at @MRockwell4.


Featured

  • Cybersecurity
    Shutterstock photo id 669226093 By Gorodenkoff

    The disinformation game

    The federal government is poised to bring new tools and strategies to bear in the fight against foreign-backed online disinformation campaigns, but how and when they choose to act could have ramifications on the U.S. political ecosystem.

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.