March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – ‘Transaction Refund’ Phishing campaign dropping malicious links
February 19, 2019
Rewterz Threat Alert – Multi-Stage Rietspoof Malware Drops Multiple Malicious Payloads
February 20, 2019
Rewterz Threat Alert – ‘Transaction Refund’ Phishing campaign dropping malicious links
February 19, 2019
Rewterz Threat Alert – Multi-Stage Rietspoof Malware Drops Multiple Malicious Payloads
February 20, 2019
Severity: High
Analysis Summary
- The attackers exploited a zero-day in the PLC firmware in order to inject a Remote Access Trojan (RAT) with escalated privileges into the firmware memory region of the controller without interrupting its normal operation and without being detected.
- The purpose of the RAT was to enable persistent access to the controller, even when the physical key was turned to RUN mode — which is designed to prevent unauthorized updates to the PLC code — rather than PROGRAM mode.
- The TRITON malware exposes yet another breed of ICS systems that attackers can now target to compromise industrial operations, the physical safety control systems – or Safety Instrumented Systems (SIS) that provide automatic emergency shutdown of plant processes, such as an oil refinery process that exceeds safe temperatures or pressures.
- trilog.exe -> main executable py2exe compile that executes python script
- library.zip -> contains all the libraries including tristation communication libraries
- inject.bin -> [Missing File] – probably responsible for placing imain.bin in the right place
- imain.bin -> Main backdoor
- Operationally, the above code indicates the next step is to deliver the initial payload and then confirm its viability to attack the device. Once confirmed it will load the injector and the main backdoor and, finally, cover its tracks.
Impact
- Injection of remote access trojan.
- Persistent access to the controller.
- Privileged access.
Remediation
- Use DMZ and firewall to prevent network traffic from passing between the corporate and the ICS network.
- Deploy strong security measures on the ICS network perimeter, including patch management, disabling unused ports, and restricting ICS user privileges.
- Log and monitor every action on the ICS network to quickly identify a point of failure.
- When possible implement redundancy on critical devices to avoid major issues
- Develop strong security policies and an incident response plan to restore systems during an incident.
- Train people with simulated incident responses and security awareness.