Threat Groups Targeting IT Over OT and How Manufacturers Can Safeguard Both Worlds

When it comes to securing the manufacturing sector, the consensus is that these organizations should focus on securing their operational technology (OT) from cyberattacks, but this isn’t the full picture.

Trustwave SpiderLabs researchers found that the average cybercriminal group would rather target conventional IT environments in manufacturing. The Trustwave SpiderLabs team discovered this information while researching its latest report, the 2023 Manufacturing Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies.

The reason threat actors would instead go through an IT system seems counterintuitive. After all, OT systems are notoriously difficult to defend due to often being older technology with new, yet often unsecured, bits and pieces bolted.

However, from what Trustwave researchers have found on Dark Web forums and markets, there is a great deal of logic and good business sense behind the decision to focus on the IT side of the house.

Threat actors predominantly still target conventional IT environments in manufacturing due to the cost-effectiveness of this approach. It enables a higher financial return on investment, achievable through well-known and available attack tools and methods normally used to attack critical points outside the factory floor.

Bridging the Gap Between IT and OT Security

Given this situation, it's imperative that manufacturers rely on cybersecurity solutions developed specifically for their environment.

The continuing prevalence of cyberattacks against the manufacturing sector highlights the evolving and critical interdependence of IT and OT systems. Recent incidents have clearly demonstrated that breaches in IT security can lead to severe disruptions in OT processes, causing halts in production, potentially endangering safety, and resulting in substantial financial losses.

The recent attacks include ransomware incidents striking an automotive parts and components manufacturer that caused the business to suspend operations and a tire maker that had to idle thousands of workers after attackers hit it with a successful ransomware attack.

Why Threat Groups Choose to Attack IT

Many often attribute the manufacturing sector's perceived susceptibility to cyber extortion to the inherent vulnerabilities within OT and IoT systems.

While these vulnerabilities make them attractive targets, Trustwave SpiderLabs' findings emphasize that key data repositories containing finance, intellectual property, and human resources information are housed within the IT network of manufacturing entities. Attackers recognize the value of these repositories and still prioritize infiltrating the IT systems to access them. 

Moreover, the prevalence of legacy systems within manufacturing compounds the challenges in protecting its infrastructure, as these systems often prove difficult to maintain or replace.

Limited visibility into technology and systems further exacerbates difficulties securing and managing the environment. Manufacturers frequently rely on suppliers to provide, maintain, and secure critical systems, introducing an additional layer of vulnerability. 

However, just because IT-focused attacks are more common, threat groups are not ignoring OT systems.

In April 2022, a threat actor attacked Ukraine's power grid. The attack used malware, including a variant of Industroyer, previously deployed in 2016. 

This new variant, called Industroyer2 targets IEC 60870-5-104 (IEC-104) protocol, used in Europe and the Middle East. Unlike its predecessor, Industroyer2 is a standalone executable consisting of a backdoor, loader, and several payload modules. Its only feature is to cause electric outages by disrupting the operation of transmission substations.

How Manufacturers Can Mitigate and Reduce Risk

The Trustwave SpiderLabs team recommends constructing a consistent framework for communication protocols and data formats. Manufacturers should establish secure connectivity measures to link IT and OT systems and perform detailed evaluations of IT and OT systems to pinpoint integration and security needs.

Additionally, adopting secure middleware or gateway solutions for IT-OT system interoperability and employing IoT platforms to integrate IT and OT systems, providing capabilities such as data ingestion, device management, analytical tools, and live monitoring.

Finally, remember the human element. Educate IT and OT staff on cooperative strategies to promote a collective security methodology and formulate interdisciplinary oversight teams (IT and OT) for integration and coordination.

Talk to us today about our OT Security Maturity Diagnostic.