The Register: Malware variants that target operational tech systems are very rare – but 2 were found last year

Feb 25, 2025

—

Source URL: https://www.theregister.com/2025/02/25/new_ics_malware_dragos/
Source: The Register
Title: Malware variants that target operational tech systems are very rare – but 2 were found last year

Feedly Summary: Fuxnet and FrostyGoop were both used in the Russia-Ukraine war
Two new malware variants specifically designed to disrupt critical industrial processes were set loose on operational technology networks last year, shutting off heat to more than 600 apartment buildings in one instance and jamming communications to gas, water, and sewage network sensors in the other.…

AI Summary and Description: Yes

**Summary:** The text discusses the emergence of two new malware variants, Fuxnet and FrostyGoop, specifically targeting industrial control systems (ICS), and highlights an increase in ransomware attacks within this sector. It underscores the unique risks posed by ICS-specific malware, the evolution of threat groups, and the concerning convergence of state-sponsored and financially motivated cybercriminals.

**Detailed Description:**
The analysis covers several crucial aspects of recent threats in industrial control systems, emphasizing the significance of the newly identified malware and its implications for cybersecurity in critical infrastructure. Here are the key points:

– **Emergence of Unique Malware:**
– **Fuxnet and FrostyGoop**: Newly discovered malware variants which disrupt critical industrial processes and were identified during the Russia-Ukraine war.
– The rarity of ICS-specific malware: Before these two, only seven variants were known, making the emergence of Fuxnet and FrostyGoop alarming.
– **Nature of Attacks**: Fuxnet targeted a municipal organization’s communication system in Moscow, while FrostyGoop disrupted heating for over 600 apartment buildings in Ukraine.

– **Ransomware Threats**:
– A staggering **87% increase** in ransomware attacks against ICS organizations from the previous year, with significant operational disruptions reported.

– **Implications for Critical Infrastructure**:
– The attacks highlight the potential for significant consequences due to malware targeting critical infrastructure. The misuse of industrial control system protocols (like Modbus by FrostyGoop) presents new vulnerabilities to a wide range of industrial operations.

– **Threat Group Dynamics**:
– New threat groups, **Bauxite** and **Graphite**, were identified, showcasing capabilities and overlaps with other known entities linked to nation-state actors.
– Bauxite has targeted various critical infrastructure sectors globally, while Graphite has exploited vulnerabilities to launch phishing and malware attacks.

– **Convergence of State and Non-State Actors**:
– The blurring lines between state-sponsored cyber activities and opportunistic criminal behavior suggest that cyber capabilities are no longer isolated. Criminal groups are gaining access to sophisticated attack methods often associated with nation-state actors.
– This convergence raises the potential frequency of high-impact attacks, stressing the need for enhanced preparedness among security professionals and critical infrastructure operators.

In conclusion, the text serves as a wake-up call to cyber and infrastructure security professionals. The rise of specific malware targeting critical systems combined with the alarming increase in ransomware incidents reinforces the urgent need for comprehensive security measures, enhanced detection capabilities, and proactive risk management strategies in the face of evolving threats.

2 5 7 a access Act AI analysis and Aria ARM art as attack attack method attack methods attacks Behavior building by C capabilities CERN CIA Col communication control control systems convergence core criminal behavior critical critical infrastructure cyber cyber activities cybercriminal cybercriminals cybersecurit Cybersecurity D de design detection detection capabilities disruption e evolving threats exp exploit exploited vulnerabilities face financial for frequency g Gen GIS Go graph Group gs H high Highlight HR http HTTPS implications in incident industrial control systems infrastructure infrastructure sector infrastructure security ite J k Key l led Link linked long making malware man management management strategies misuse nation nation-state actors network networks NIST no non o of off on one operation operational disruption operational technology Operator organization organizations over phi phishing point potential pre proactive proactive risk management process processes professionals protocol protocols R rag ransom ransomware ransomware attack ransomware attacks ransomware threats rate RCE red report Risk risk management risk management strategies risks Ro RoT Russia s sec security security measure security measures security professionals sensors sequence Sig SoC source specific sponsored sponsored cyber activities SSE state state actors state-sponsored state-sponsored cyber activities system systems T targeted tech technology text the threat threat group threat groups threats to Tor TP trial two UI UK Ukraine up ups US use V vulnerabilities Wi x