Sandworm Team – Historical Targeting of Ukraine and Interest in SCADA Systems
Since last week, iSIGHT Partners has worked to provide details on the power outage in Ukraine to our global customers. We have analyzed the forensic evidence we have been able to obtain from the region, contextualizing it within our knowledge of cyber espionage actors. Many details of the event remain unknown, and given the nature of the incident, especially the use of destructive malware, we do not anticipate every detail will be exposed.
However, we have linked Sandworm Team to the incident, principally based on BlackEnergy 3, the malware that has become their calling card.
iSiGHT Partners has tracked Sandworm Team for some time – and we publicly reported on some of their activities in October 2014, when we discovered their use of a zero-day exploit, CVE-2014-4114. In that campaign, we saw targeting of Ukrainian government officials, members of the EU and NATO. Shortly after releasing information on their espionage operations, our friends at TrendMicro found evidence that the operators were not only conducting classic strategic espionage but targeting SCADA systems as well. Evidence of this accumulated, and iSIGHT Partners released a follow-up blog were we assessed that activity was reconnaissance for attack – a preparation for cyber attack to be carried out in the long term. ICS-CERT released a separate advisory as well.
Sandworm Team Activity – Late 2014 to Current Day
Sandworm Team went to ground shortly after being exposed in October of 2014, and malware with Dune references (the genesis for the ‘Sandworm’ moniker) which we had previously used to track them disappeared entirely. However, the unique malware variant, BlackEnergy 3, reemerged in Ukraine early in 2015, where we had first found Sandworm Team. Throughout 2015 we saw increased intrusion activity using BlackEnergy 3. We warned our clients of new features suggesting an increased focus on European targets – though verification of targets was not possible at the time. Additionally, we warned our customers about the targeting of both media and regional power authorities in the Ukraine, sectors later affected by cyber attacks. Some of this information was recently shared by the folks at ESET, who have also been following Sandworm Team very closely for quite some time.
On the Ukrainian Power Authority Incidents
Last week iSIGHT’s sources provided us with the same KillDisk malware published by Rob Lee of SANS and Dragos Security. As ESET has, we place this malware within the greater context of activity tied to BlackEnergy 3, which we believe is Sandworm Team. We believe this KillDisk malware is related to the destructive malware leveraged during Ukrainian elections in October. At the time, CERT-UA connected that incident to BlackEnergy 3. Symantec has since verified those claims. Furthermore, iSIGHT’s own sources indicate that BlackEnergy 3 malware was deployed on at least one of the Ukrainian power systems affected by KillDisk.
iSIGHT Partners is still collecting information on the mechanics of the power outage and what role the KillDisk malware played in the greater event. We cannot confirm that the KillDisk malware caused the outage. It may have been used following steps to manipulate power in order to impede restoration efforts or operator visibility. It is noteworthy that technical support numbers associated with the power authorities were allegedly flooded with calls, which may have been an effort to further overwhelm responders. On their official website, the Ukrainian security service, SBU, made this claim.
Outlook
A cyber attack of this nature is a milestone –although a predictable one. The aggressive nature of Sandworm Team’s previous activity in Europe and the United States exposed their interest in targeting critical systems and indicated preparation for cyber attack. Targeting of critical entities in Ukraine throughout 2015, during a time of war, further presaged a desire to disrupt infrastructure.
The post Sandworm Team and the Ukrainian Power Authority Attacks appeared first on iSIGHT Partners.
