When it comes to choosing a manufacturer to target for attack, threat groups have a healthy list of tools from which to choose. All of which are made more powerful due to this industry’s complex cybersecurity posture, driven by the increasing integration of IT/OT environments.
The report goes into in-depth detail on these methods, but here is a quick look at Trustwave SpiderLabs’ findings:
Web Shells – Web shells are particularly dangerous for manufacturing companies, enabling attackers to infiltrate production environments, gather sensitive information, and establish a persistent presence for extended operations.
Vulnerability Exploitation– The report contains a list of vulnerabilities (CVEs) collected via Shodan. Researchers found that manufacturing organizations had 4370 unique vulnerabilities (out of a total of 24920) that were publicly exposed on the Internet. About 3800 of these vulnerabilities are critical vulnerabilities, and 3532 were listed in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerability (KEV) list.
Publicly Accessible Industrial Control Systems– Industrial Control Systems (ICSs) are essential in manufacturing and automating processes. However, connecting ICS to networks exposes them to cybersecurity threats, such as malware and ransomware attacks. Trustwave SpiderLabs conducted one search that found more than 40 publicly exposed ICS systems.
Credential Stealer Marketplaces– Credential stealer log marketplaces on the Dark Web are hubs where cybercriminals trade stolen login details for various systems, including corporate email accounts, and operational technology systems. These credentials are harvested in a variety of ways, as detailed in the report.
Noteworthy Phishing Campaigns– As always, phishing is a preferred method of gaining initial access; however, different phishing attacks are in use, and in the report, SpiderLabs lists several of the tricks adversaries use to convince their victims to do their bidding.
The cyber threats manufacturers face will not diminish, and as more organizations connect their production lines and systems to wider networks and the Internet, they must be prepared to defend their ground.