{"id":42221,"date":"2023-06-21T15:47:45","date_gmt":"2023-06-21T12:47:45","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=42221"},"modified":"2026-03-28T03:36:34","modified_gmt":"2026-03-28T00:36:34","slug":"kaspersky-names-top-factors-driving-apt-attacks-in-industrials","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/kaspersky-names-top-factors-driving-apt-attacks-in-industrials\/","title":{"rendered":"Kaspersky names top factors driving APT attacks in industrials"},"content":{"rendered":"\n

The key contributors to the success of the Advanced Persistent Threat (APT) operations inside their victims’ networks include human factors, insufficient security measures, challenges with updates and configuration of cybersecurity solutions, and other factors. While some of these reasons may appear trivial, they are frequently encountered by Kaspersky experts during their incident response activities. To assist companies mitigate related threats and ensuring the implementation of best practices, Kaspersky ICS CERT experts have compiled\u00a0<\/strong>a list<\/strong><\/a>\u00a0of the most prevalent issues.<\/strong><\/p>\n\n\n\n

Lack of OT network isolation\u00a0<\/strong><\/p>\n\n\n\n

During incident investigations, Kaspersky experts witnessed cases when there were problems with keeping the Operational Technology (OT) network separate and secure. For example, there are machines such as engineering workstations connected to both the regular IT network and the OT network.  <\/p>\n\n\n\n

\u201cIn situations where the OT network’s isolation solely relies on the configuration of networking equipment, experienced attackers can always reconfigure that equipment to their advantage<\/em>,\u201d – said Evgeny Goncharov, Head of Industrial Control Systems Cyber Emergency Response Team at Kaspersky. \u201cFor instance, they can turn it into proxy servers to control malware traffic or even use it to store and deliver malware to networks that were believed to be isolated. We have witnessed such malicious activities on multiple occasions.<\/em>\u201d<\/p>\n\n\n\n

Human factor remains a driver of cybercriminal activities<\/strong><\/p>\n\n\n\n

When granting access to OT networks to employees or contractors, information security measures are often overlooked. Remote administration utilities like TeamViewer or Anydesk, initially set up temporarily, may remain active unnoticed. However, it\u2019s crucial to remember that these channels are easily exploited by attackers. In 2023, Kaspersky investigated an incident where a contractor attempted sabotage, by taking advantage of remote access to the ICS network legitimately granted to them several years before. <\/p>\n\n\n\n

This story demonstrates the importance of considering the human factor as any potentially dissatisfied employees may be driven by their work assessments, income, or political motivations, leading them to engage in cybercriminal actions. A possible solution in such a situation can be Zero Trust \u2013 the concept assuming that neither the user, device, nor application within the system is trusted. Unlike other Zero-Trust solutions, Kaspersky extends Zero Trust approach down to the Operating System level with its KasperskyOS based solutions.<\/p>\n\n\n\n

Insufficient protection of OT assets<\/strong><\/p>\n\n\n\n

During incident analysis, Kaspersky experts have discovered outdated security solution databases, missing license keys, user-initiated removal of keys, disabled security components, and excessive exclusions from scanning and protection \u2013 all contributing to the spread of malware.<\/p>\n\n\n\n

For example, if your databases are not up-to-date and a security solution can\u2019t be updated automatically, it can allow advanced threats to quickly and easily propagate as in APT attacks, where sophisticated threat actors are trying to avoid detection. <\/p>\n\n\n\n

Insecure configurations of security solutions<\/strong><\/p>\n\n\n\n

Proper configurations of a security solution are crucial to prevent it from disabling or even abusing it \u2013 a tactic often seen to be employed by APT groups\/actors. They may steal information on the victims\u2019 network stored in the security solution to get into other parts of the system, or move laterally, using professional infosec language. <\/p>\n\n\n\n

In 2022, Kaspersky ICS CERT noticed a new trend in APT tactics, which makes proper configurations even more vital. For instance, when searching for ways to move laterally, the attackers no longer stop at hijacking critical IT systems, like domain controller. They proceed for next target – the administration servers of security solutions. The goals may vary \u2013 from putting the malware on a list of programs that won\u2019t be checked to using tools in the security system to spread it to other systems, even those that are supposed to be completely separate from the infected network.<\/p>\n\n\n\n

The absence of cybersecurity protection in OT networks<\/strong><\/p>\n\n\n\n

It might be hard to believe, but on some OT networks, cybersecurity solutions are not installed on many endpoints at all. Even if the OT network is completely separated from other networks and not connected to the internet, attackers still have ways of gaining access to it. For example, they can create special versions of malware that are distributed via removable drives, such as USBs. <\/p>\n\n\n\n

Workstations and servers\u2019 security updates challenges<\/strong><\/p>\n\n\n\n

Industrial control systems have a unique way of functioning, where even simple tasks like installing security updates on workstations and servers need careful testing. This testing often happens during scheduled maintenance, causing updates to be infrequent. This gives threat actors plenty of time to exploit known weaknesses and carry out their attacks. <\/p>\n\n\n\n

\u201cIn some cases, updating the server’s operating system may require updating specialized software (like the SCADA server), which in turn requires upgrading the equipment \u2013 that all may be too expensive. Consequently, there are outdated systems found on industrial control system networks,<\/em>\u201d adds Goncharov. \u201cSurprisingly, even internet-facing systems in industrial enterprises, which can be relatively easy to update, can remain vulnerable for a long time. This exposes the operational technology (OT) to attacks and serious risks, as real-world attack scenarios have shown.<\/em>\u201d <\/p>\n\n\n\n

More advice is published on the\u00a0Kaspersky ICS CERT blog<\/a>, such as those related to security solutions configuration and settings, OT network isolation, protecting systems, running outdated OS, application software, and device firmware. To protect your organization from relevant threats, Kaspersky experts recommend:<\/p>\n\n\n\n