Password recovery tools offered for industrial controllers have been used to spread the Sality trojan. Researchers found that the tools, advertised on social media, use known device flaws to reveal passwords while quietly installing malware. The campaign concerns anyone who runs industrial control systems or PLCs.
Public reporting describes a malware distribution campaign to industrial control systems (ICS) through password recovery tools developed for programmable logic controllers (PLC). Password recovery tools that are advertised on various social media platforms promise to recover passwords of systems used in industrial control environments such as Automation Direct, Omron, Siemens, Fuji Electric, Mitsubishi, LG, Vigor, Pro-Face, Allen Bradley, Weintek, PLC, ABB, Panasonic, and HMI.What do these password recovery tools really do?
These password recovery tools use known security vulnerabilities in devices to reveal system passwords. However, these tools inject a trojan software called Sality into vulnerable systems in the background. Sality is a long-running peer-to-peer botnet malware. It can inject itself into running processes and spread through network shares and removable storage. CISA describes it as a polymorphic file infector discovered in 2003.- Tool is advertisedPassword recovery tools for controllers are promoted on social media
- Tool reveals passwordsIt uses known device vulnerabilities to reveal system passwords
- Sality is injectedA trojan is installed in the background on the vulnerable system
- Sality actsIt injects into running processes and can spread through network shares and removable storage
- Botnet and hijackingPeer-to-peer links can make the system part of a botnet; the sample hijacked cryptocurrency
Also, thanks to the Sality trojan’s ability to communicate over a peer-to-peer (P2P) network, infected systems can become part of a botnet network controlled by threat actors. The Sality sample that was analyzed also hijacked the clipboard to carry out cryptocurrency theft from vulnerable systems.
How can industrial operators reduce the risk?
In this context, it is important to apply the following security measures in order not to be the target of similar malware campaigns targeting critical/sensitive systems;- It should be ensured that the systems, software, and hardware used are always used in the current versions where the vulnerabilities are fixed,
- Comprehensive and reliable Anti-Virus / Anti-Malware and Firewall solutions should be used,
- User privileges on systems should be limited,
- E-mails, attachments, and links from unknown parties should not be respected,
- Application, program/software downloads must be made through legitimate and reliable sources,
- Avoid downloading cracked software,
- Institution/organization personnel should be made aware of potential phishing/social engineering attacks,
- Passwords used in systems should be created using unique and strong policies,
- Detected IOC findings regarding the malware should be blocked from the security solutions in use.