Hackers wielding some of the most dangerous malware ever used are roving US infrastructure for potential targets, say two security firms.
In a report from Wired, the security firms, Electric Information Sharing and Analysis Center and Dragos both confirm that hackers behind harrowing attacks on critical infrastructure have been eyeing targets in the US power grid throughout the last several months.
The hackers, called Xenotime, are reportedly the same group who leveraged an infamous malware called ‘Triton’ to shut down critical safety instruments at a Saudi-Arabian oil refinery, putting the plant at risk of a potential explosion.
Instead, the attackers inadvertently triggered an emergency shutdown and operators were able to regain control.
Researchers note that the detected efforts are still preliminary and there’s currently no evidence that the group has breached US targets, but given the potential to do real harm, the findings have raised alarms.
Already, researchers report the group has tested networks in 20 different electric systems.
These initial moves represent what one representative for Dragos who was interviewed by Wired categorizes as ‘knocking on the door and trying a couple of doorknobs every once in a while.’
They have also confirmed some activity in the Asia-Pacific and other more serious attempts where hackers attempted to tap into networks at infrastructure facilities.
The reports follow up previous warnings in April from researchers at the firm FireEye who say they had found traces of Triton have for the second time since 2017, when hackers leveraged it to gain control of critical processes at an oil plant in Saudi Arabia.
In a report, the firm did not reveal exactly where the attack happened, who the target was, or even how much damage, if any, was done, though it did highlight some of the group’s apparent intentions.
WHAT IS TRITON MALWARE?
