Assessing an Industrial Control System in the oil and gas sector

To mitigate threats effectively, it is essential to gain strong visibility into the client’s assets, operations, and threats across the full environment. By understanding these threats and risks, and the attack paths through which they could be realized, we carried out a thorough security assessment of the ICS.

We began by conducting a network mapping exercise to understand connections between ICS components and related systems, and to identify potential attack paths to critical ICS assets. Each system was then analyzed in more detail to determine what security capabilities were present by design and how they could be leveraged.

This work used multiple data-gathering techniques, including interviews with the client’s subject matter experts, network and control system serial traffic captures, and documentation reviews. During network mapping, we identified unusual traffic that appeared inconsistent with expected system behavior.

To learn more about the traffic, we submitted the patterns and content to our internal AV lab analysts. The team has experience in static, dynamic, and reverse engineering malware analysis. They confirmed the traffic was malware and conducted further analysis to help us understand its purpose and impact, as well as the attacker’s objectives and methods. The analysis linked the malware to a well-known Advanced Persistent Threat (APT) group.

As the attacker was live on the client’s ICS, this represented a significant risk. The facility under assessment formed part of the country’s critical national infrastructure. After identifying the APT group, we alerted local authorities regarding the threat actor. We then liaised with the authorities and provided a thorough handover of the information needed to enable rapid incident response and forensic activities.