Experts have made a disconcerting discovery on the Dark Web, finding a sophisticated government malware that could be used to target energy grids
Much has been reported about the militarization of cyberspace and the risks that a government malware goes out of control… what if a powerful hacking tool is leaked online?
Lorenzo Bicchierai from Motherboard reported some disconcerting news, that a sophisticated strain of government-made malware was found on a forum on the Dark Web.
The tool was designed to target critical infrastructure. It is a reconnaissance malware that could be used in a first stage to attack an energy grid system.
The disconcerting aspect of the story is that this kind of malware is not available on the black market, they are a prerogative of well-founded ATP groups.
Recently security experts from SentinelOne spotted a malware dubbed Furtim that was involved in an attack against one European energy firm. The threat is highly sophisticated and could be used to exfiltrate data from target systems and “to potentially shut down an energy grid.”
Udi Shamir, chief security officer at SentinelOne told MotherBoard that is very strange to find such a complex malware on a hacking forum.
“it was very surprising to see such a sophisticated sample” appear in hacking forums, he explained to Motherboard.
Shamir pointed out that the Furtim malware is the result of a significant effort of state- sponsored hackers involved in cyber espionage operations.
The authors of the Furtim threat designed the malware to avoid common antivirus solutions, as well as a virtualized environment and sandboxes used to analyze malicious codes.
Unfortunately critical infrastructure worldwide is still too vulnerable to cyber attack; the recent NIS directive passed by the EU establishes minimum requirements for cyber-security on critical infrastructure operators.
In the past, malware-based attacks have targeted critical infrastructure. For example, the Stuxnet virus used against the Iranian enrichment program or the BlackEnergy malware used to target companies in the energy industry. Experts speculated that BlackEnergy was also involved in the Ukrainian outage.
Shamir confirmed that this latest malware is the work of a government, likely from Eastern Europe.
(Security Affairs – government malware, Furtim)
Share On
