Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Threat Groups Targeting IT Over OT and How Manufacturers Can Safeguard Both Worlds

When it comes to securing the manufacturing sector, the consensus is that these organizations should focus on securing their operational technology (OT) from cyberattacks, but this isn’t the full picture.

 

Trustwave SpiderLabs researchers found that the average cybercriminal group would rather target conventional IT environments in manufacturing. The Trustwave SpiderLabs team discovered this information while researching its latest report, the 2023 Manufacturing Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies.

 

The reason threat actors would instead go through an IT system seems counterintuitive. After all, OT systems are notoriously difficult to defend due to often being older technology with new, yet often unsecured, bits and pieces bolted.

 

However, from what Trustwave researchers have found on Dark Web forums and markets, there is a great deal of logic and good business sense behind the decision to focus on the IT side of the house.

 

Threat actors predominantly still target conventional IT environments in manufacturing due to the cost-effectiveness of this approach. It enables a higher financial return on investment, achievable through well-known and available attack tools and methods normally used to attack critical points outside the factory floor.

 

Bridging the Gap Between IT and OT Security

 

Given this situation, it's imperative that manufacturers rely on cybersecurity solutions developed specifically for their environment.

 

The continuing prevalence of cyberattacks against the manufacturing sector highlights the evolving and critical interdependence of IT and OT systems. Recent incidents have clearly demonstrated that breaches in IT security can lead to severe disruptions in OT processes, causing halts in production, potentially endangering safety, and resulting in substantial financial losses.

 

The recent attacks include ransomware incidents striking an automotive parts and components manufacturer that caused the business to suspend operations and a tire maker that had to idle thousands of workers after attackers hit it with a successful ransomware attack.

 

Why Threat Groups Choose to Attack IT

 

Many often attribute the manufacturing sector's perceived susceptibility to cyber extortion to the inherent vulnerabilities within OT and IoT systems.

 

While these vulnerabilities make them attractive targets, Trustwave SpiderLabs' findings emphasize that key data repositories containing finance, intellectual property, and human resources information are housed within the IT network of manufacturing entities. Attackers recognize the value of these repositories and still prioritize infiltrating the IT systems to access them. 

 

Moreover, the prevalence of legacy systems within manufacturing compounds the challenges in protecting its infrastructure, as these systems often prove difficult to maintain or replace.

 

Limited visibility into technology and systems further exacerbates difficulties securing and managing the environment. Manufacturers frequently rely on suppliers to provide, maintain, and secure critical systems, introducing an additional layer of vulnerability. 

 

However, just because IT-focused attacks are more common, threat groups are not ignoring OT systems.

 

In April 2022, a threat actor attacked Ukraine's power grid. The attack used malware, including a variant of Industroyer, previously deployed in 2016. 

 

This new variant, called Industroyer2 targets IEC 60870-5-104 (IEC-104) protocol, used in Europe and the Middle East. Unlike its predecessor, Industroyer2 is a standalone executable consisting of a backdoor, loader, and several payload modules. Its only feature is to cause electric outages by disrupting the operation of transmission substations.

 

How Manufacturers Can Mitigate and Reduce Risk

 

The Trustwave SpiderLabs team recommends constructing a consistent framework for communication protocols and data formats. Manufacturers should establish secure connectivity measures to link IT and OT systems and perform detailed evaluations of IT and OT systems to pinpoint integration and security needs.

 

Additionally, adopting secure middleware or gateway solutions for IT-OT system interoperability and employing IoT platforms to integrate IT and OT systems, providing capabilities such as data ingestion, device management, analytical tools, and live monitoring.

 

Finally, remember the human element. Educate IT and OT staff on cooperative strategies to promote a collective security methodology and formulate interdisciplinary oversight teams (IT and OT) for integration and coordination.

 

MFG-1TTalk to us today about our OT Security Maturity Diagnostic.

 

 

 

Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More