Threat analysis study: LockBit

Posted on 23/03/2023, by
INCIBE (INCIBE)
Study decorative image
En este estudio, se expone brevemente el origen y evolución de la amenaza ransomware LockBit 3.0, a través del análisis de varias muestras maliciosa, con el objetivo de facilitar la información necesaria para poder identificar las características propias de este malware, su comportamiento y técnicas empleadas, permitiendo así una mejor identificación y respuesta ante ella.

ICS’S future is in the space

Posted on 20/03/2023, by
INCIBE (INCIBE)
space satellite
There are areas where the deployment of an industrial plant requires satellite communications such as those provided by VSAT (Very-Small-Aperture Terminal) technology. This technology allows the exchange of information through an antenna made up of different terminals, installed in remote locations with the connection capacity of a central hub, thanks to a satellite. Obviously, this technology has a cost that not all companies can afford, but it covers coverage needs in places where there are no other communication options. This type of communications is not only widespread in the industry, but its also sometimes used by banks to perform banking transactions at ATM’s. These communications are not so well known by many experts in the industrial sector, and it can be a good opportunity to bridge the knowledge gap so that readers can learn more about the advantages and disadvantages of VSAT communications.

Virtual Power Plants: ‘The Internet of Energy’

Posted on 16/03/2023, by
INCIBE (INCIBE)
Decorative image Virtual Power Plants: ‘The Internet of Energy’
Energy efficiency alternatives are nowadays on everyone’s lips given the energy crisis that is plaguing the vast majority of European regions. In Spain, the energetic companies are following alternatives based on the use of different technologies to solve problems as complex as such as the management of surplus energy in some infrastructures. One of the alternatives that seems to have greater depth within the sector is the use of Virtual Power Plant (VPP). This new concept of energy management makes it possible to interweave different energy sources into a single flow of electricity demand, managed through a global solution that is usually deployed in the cloud due to the amount of data that has to be processed. The management system proposed by Virtual Power Plant is simple: Take advantage of surplus energy from microgrids to balance supplies to infrastructures that need this energy. With this gesture, large distributors can take advantage of up to almost 100% of the power within all infrastructures, such as electric vehicle chargers, solar farms, wind turbine farms, etc.

Tactics and techniques of the bad guys in SCI

Posted on 07/03/2023, by
INCIBE (INCIBE)
Hacked screen detected decorative image
Industrial Control Systems (ICS) were initially designed to work in sealed environments and as stand-alone systems, interconnections between systems were scarce, as were safety protections. The constant evolutions in the field of ICS, including the inclusion of a large number of communication protocols, IIoT devices, the expansion of interconnections, an incessant search for interoperability between systems and the inclusion of these architectures in critical systems, has meant that the networks on which these industrial control systems, has meant that the networks on which these industrial control systems are built, also known as control networks, have increased their security exponentially.

System hardening: the case of Linux

Posted on 02/03/2023, by
INCIBE (INCIBE)
System hardening: the case of Linux Cover
Knowing the resources available when performing tasks of hardening a system, will allow us to optimize the time necessary to obtain a safer system. In addition, we have the possibility of using tools capable of auditing the system that identifies those configurations that are considered safe and which ones we could implement.

The importance of radio frequencies in industry

Posted on 23/02/2023, by
INCIBE (INCIBE)
Hands with a controller
In industrial environments there are a multitude of technologies, manufacturers, communications, etc. This article will reflect a small part of the protocols that use radio frequency (RF) communications. Thanks to these wireless communications, operators in the industrial world can send a simple order to obtain information on the status of a sensor or execute control orders in the industrial environment. The importance of a good implementation, in terms of cybersecurity of these communications, is quite high since, on occasions, some of the attacks that have been investigated have an impact on the physical world, giving rise to incidents that can even result in fatalities.

Red Team in mysterious waters

Posted on 16/02/2023, by
INCIBE (INCIBE)
Decorative image red team sports
The proliferation of cybersecurity incidents in industrial environments has given rise to a huge concern in the various existing sectors. Some of them, such us the energy sector, are choosing the path taking in the banking sector with the TIBER-EU framework. In addition, many governments are allocating large sums of money to their government agencies to develop strategic plans in which that exercises are included

Industroyer2, the ampere strikes back

Posted on 09/02/2023, by
INCIBE (INCIBE)
Factory drawing
Confrontations between countries no longer only take place in the physical world, in this new decade, these confrontations also move to the cyber world. The conflict between Russia and Ukraine is one of the clearest examples. Among the events that have taken place is the security incident known as Industroyer2, which affected an electrical supplier in Ukraine. The Industroyer2 is the evolution of its predecessor, the malware known as Industroyer, which was able to affect multiple protocols of industrial control systems during its execution. This new variant of the malware focuses on a particular communications protocol, IEC-104, which is widely used in Europe and the Middle East to monitor and control the power system via the TCP/IP communications protocol.