When it comes to choosing a manufacturer to target for attack, threat groups have a healthy list of tools from which to choose. All of which are made more powerful due to this industry’s complex cybersecurity posture, driven by the increasing integration of IT/OT environments.
To help manufacturer sector security teams better understand the forces arrayed against them, Trustwave SpiderLabs has just released the report Manufacturing Sector Deep Dive: Methods of Targeting and Breaching, which studies the most common methods attackers use along with recommendations to mitigate the threats.
This deep dive is a supplemental report to other recently released Trustwave SpiderLabs research on the sector:
Threat Group Attack Methodologies
The report goes into in-depth detail on these methods, but here is a quick look at Trustwave SpiderLabs’ findings:
- Web Shells – Web shells are particularly dangerous for manufacturing companies, enabling attackers to infiltrate production environments, gather sensitive information, and establish a persistent presence for extended operations.
- Vulnerability Exploitation – The report contains a list of vulnerabilities (CVEs) collected via Shodan. Researchers found that manufacturing organizations had 4370 unique vulnerabilities (out of a total of 24920) that were publicly exposed on the Internet. About 3800 of these vulnerabilities are critical vulnerabilities, and 3532 were listed in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerability (KEV) list.
- Publicly Accessible Industrial Control Systems – Industrial Control Systems (ICSs) are essential in manufacturing and automating processes. However, connecting ICS to networks exposes them to cybersecurity threats, such as malware and ransomware attacks. Trustwave SpiderLabs conducted one search that found more than 40 publicly exposed ICS systems.
- Credential Stealer Marketplaces – Credential stealer log marketplaces on the Dark Web are hubs where cybercriminals trade stolen login details for various systems, including corporate email accounts, and operational technology systems. These credentials are harvested in a variety of ways, as detailed in the report.
- Noteworthy Phishing Campaigns – As always, phishing is a preferred method of gaining initial access; however, different phishing attacks are in use, and in the report, SpiderLabs lists several of the tricks adversaries use to convince their victims to do their bidding.
The cyber threats manufacturers face will not diminish, and as more organizations connect their production lines and systems to wider networks and the Internet, they must be prepared to defend their ground.
A great start toward this goal is to download Manufacturing Sector Deep Dive: Methods of Targeting and Breaching and its companion pieces:
