Cybersecurity company “Kaspersky” has published the “Industrial Control System Threat Landscape” report for H2 2020, which is based on statistical data collected by the Kaspersky Security Network (KSN) antivirus. The data analyzed by the experts was obtained from industrial control system (ICS) computers using Kaspersky security products. It is noteworthy that according to the report, 33.4% of ICS computers were hacked in H2 2020.
Read also: Microsoft: Users still not updating Windows 10
Windows systems included in the analyses perform one of the following functions:
- Supervisory control and data acquisition (SCADA) systems
- Data storage servers
- Data gateways (OPC)
- Fixed workstations for engineers and operators
- Mobile workstations for engineers and operators
- Human-Machine Interface (HMI)
- Computers used to manage industrial networks
- Computers used to develop software for industrial automation systems
The percentage of ICS computers affected by a cyberattack in the second half of 2020 globally is 33.4%, (+0.85% from the first half of 2020). In H2 2020, the percentage of ICS computers “hit” by hackers increased, compared to H1, to 62% of countries. The same percentage was 7% in 2019 and H1 2020, compared to H2 2019.
See also: FBI/CISA: Beware! APT hackers target Fortinet FortiOS servers
The country that saw the largest increase in the number of attacks was Saudi Arabia (+8.2%).
Initial data from the report shows a decline in ransomware attacks on ICS computers, despite the fact that such attacks increased in developed countries.
Globally, ICS computers infected with ransomware decreased from 0.63% in the first half of 2020 to 0.49% in the second half of the year. In contrast, in some countries experts observed an increase, including the US and Canada (+0.25%), Australia (+0.23%) and Western Europe (+0.13%)..
Proposal: Cyberattack on Larnaca Airport hermesairports.com by RootAyyildiz!
Kaspersky’s report notes the following: “We believe that these strange dynamics could indicate the response of malicious actors to the economic consequences of the pandemic. In those countries where the “creditworthiness” of organizations decreased as a result of the pandemic, the number of attacks on industrial enterprises decreased (as did the percentage of ICS computers attacked). At the same time, in countries where industrial organizations were generally more financially stable and were still able to pay ransoms, the activity of attackers increased (as did the percentage of ICS computers attacked). The changes we observed may be due, among other things, to a shift in the focus of some groups when selecting victims, towards organizations located in more stable countries.”
In 2020, Kaspersky solutions blocked ransomware infection attempts on 0.77% of ICS devices, while the percentage of ICS computers targeted with cyberattacks was higher in Asia compared to the rest of the world.
In 2020 as a whole, the percentage of ICS computers on which Kaspersky solutions blocked malicious “objects” amounted to 38.6% (-7.8% since 2019). Unlike previous years, in 2020, experts did not observe seasonal fluctuations in cyberattacks.
Which were the "safest" countries in H2 2020 according to Kaspersky?
Israel took first place in H2 2020 with a record low of 4.3%, followed by Denmark (7.2%) and Ireland (8.6%) .
The Internet, removable media and email continue to be the main attack vectors for computer systems in organizations’ industrial infrastructure.
Finally, Kaspersky states in its report that it blocked over 19,400 malware, from 5,365 different families, in industrial automation systems.
Information source: securityaffairs.co
