Critical Infrastructure Network Attacks: Code Red, Alert Network Operators

### Overview In this talk, Israel Barak, CISO at Cybereason, presents findings from a honeypot study designed to emulate an electric transmission substation network. Using internal and external network identifiers closely mirroring a major electricity provider, the research aimed to track evolving adversary tactics, techniques, and practices (TTPs) across combined IT and operational technology (OT) environments. The findings revealed that industrial control system (ICS) environments are no longer targeted solely by advanced persistent threat (APT) or nation-state groups; cybercrime threat actors are actively targeting critical infrastructure using multi-stage ransomware playbooks.

### Key Topics - **Ransomware Evolution**: Contrasting traditional single-stage ("shotgun") ransomware—which detonates immediately upon impact with low customization and blunt tools—with multi-stage ransomware operations. Multi-stage attacks function as comprehensive post-breach hacking campaigns aimed at high extortion payouts by executing credential theft, data exfiltration, lateral movement, and simultaneous detonation across critical enterprise systems. - **Honeypot Architecture**: Modeled after a typical electrical transmission substation featuring an external DMZ with remote technician interfaces, firewall segregation between IT and OT segments, Windows and Linux hosts, openSCADA-based Human-Machine Interface (HMI) systems, and ICS controllers, all monitored via Cybereason endpoint sensors. - **IT-to-OT Traversal**: The observation of cybercrime actors possessing ready playbooks to pivot across firewalled segmentation from corporate IT networks into OT networks.

### Technical Details - **Initial Access & Persistence (Days 0–2)**: Two days after connecting the honeypot to the internet, automated scanning brute-forced the local administrator password on an external Remote Desktop Protocol (RDP) remote technician interface. The actor performed active directory and reverse DNS discovery, used PowerShell to deploy first-stage tooling and initiate data theft, and created a backup local administrator account for persistence. - **Lateral Movement & Tool Staging (Days 4–23)**: Following an apparent handoff between threat actors, the secondary operator dumped credentials from memory using Mimikatz and moved laterally through the IT environment using SMB and PsExec. The actor staged commodity ransomware into temporary folders on compromised hosts without detonating it, while stealing data files. - **OT Pivot (Day 23)**: After 19 days of navigating the IT environment, the attacker discovered an IT service with access to the HMI data stream. The adversary exploited a web service vulnerability in the openSCADA HMI to pivot across the firewall into the Linux-based OT segment. - **OT Lateral Movement & Detonation (Days 23–24)**: Inside the OT network, the actor utilized the pass-the-ticket technique and SMB to propagate across hosts, exfiltrating data via command-and-control channels and staging ransomware. On day 24, after exhausting lateral movement opportunities, the ransomware was detonated simultaneously across both IT and OT environments, shutting down systems and issuing a ransom demand.

### Takeaways - **Broadening Threat Landscape**: The attacker exhibited commodity tooling (Mimikatz, PsExec, standard discovery utilities) indicative of cybercrime groups rather than stealth-focused APTs, yet possessed a dedicated playbook for pivoting from IT to OT. - **Adversary Risk in Fragile Environments**: Untrained or profit-motivated cybercrime actors operating in fragile legacy ICS environments are prone to causing unintended, severe operational disruptions and physical failures out of ignorance. - **Unified IT/OT SOC Visibility**: Organizations must unify security operations center (SOC) monitoring across IT and OT rather than isolating OT to a network operations center (NOC), ensuring visibility across IT-to-OT transit points. - **Proactive Threat Hunting**: Relying solely on static alerts or immediate detonation indicators is insufficient against multi-stage operations that dwell for weeks. Proactive threat hunting and behavioral endpoint detection are essential to detect and remediate intrusions before payload detonation.