ICS Threat Analysis: New Malware Can Kill Engineering Processes
Essential information
- Published
- 18/12/2024 14:43
- Modified
- 18/12/2024 15:07
- Tags
- 2024-12-18 chaya_003 discord c2 engineering workstations ics mitsubishi ot process-termination ramnit siemens
- Related entities
- 20 observables, 9 techniques (mitre), 2 malware, 6 others
Description
An analysis of a public malware repository reveals a persistent presence of OT/ICS malware, with engineering workstations being a significant target. Two notable clusters were identified: Mitsubishi engineering workstation software infected with the Ramnit worm, and a new experimental malware named Chaya_003 capable of terminating Siemens engineering processes. The research highlights the evolving threat landscape in OT/ICS environments, emphasizing the need for enhanced security measures. Recommendations include hardening engineering workstations, proper network segmentation, and implementing comprehensive threat monitoring solutions across both IT and OT systems.