August 9, 2022

Cyber Tactics in the Russo-Ukrainian Conflict

The conflict between Russia and Ukraine has led to fears of a full-scale cyberwar. Learn the cyber attack tactics used, hacking groups involved, and more!

Written by

Rosa Jong

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Rosa Jong

OSINT Analyst

Written by

Taisiia Garkava

Security Analyst

Aug 2022

Introduction

Since the beginning of the Russian invasion of Ukraine in February 2022, cyber communities around the world have been witnessing what can be called a ‘renaissance of cyberwarfare' [1]. Rather than being financially motivated, threat actors are being guided by political convictions to defend allies or attack their enemies. This blog reviews some of the main threat actors involved in this conflict and their ongoing tactics, and advises on how organizations can best protect themselves. Darktrace’s preliminary assessments predicted that attacks would be observed globally with a focus on pro-Ukrainian nations such as North Atlantic Treaty Organization (NATO) members and that identified Advanced Persistent Threat (APT) groups would develop new and complex malware deployed through increasingly sophisticated attack vectors. This blog will show that many of these assessments had unexpected outcomes.

Context for Conflict

Cyber confrontation between Russia and Ukraine dates back to 2013, when Viktor Yanukovych, (former President of Ukraine) rejected an EU trade pact in favour of an agreement with Russia. This sparked mass protests leading to his overthrow, and shortly after, Russian troops annexed Crimea and initiated the beginning of Russian-Ukrainian ground and cyber warfare. Since then, Russian threat actors have been periodically targeting Ukrainian infrastructure. One of the most notable examples of this, an attack against their national power grid in December 2015, resulted in power outages for approximately 255,000 people in Ukraine and was later attributed to the Russian hacking group Sandworm [2 & 3].

Another well-known attack in June 2017 overwhelmed the websites of hundreds of Ukrainian organizations using the infamous NotPetya malware. This attack is still considered the most damaging cyberattack in history, with more than €10 billion euros in financial damage [4]. In February 2022, countries witnessed the next stage of cyberwar against Ukraine with both new and familiar actors deploying various techniques to target their rival’s critical infrastructure.

Tactic 1: Ransomware

Although some sources suggest US ransomware incidents and expectations of ransom may have declined during the conflict, ransomware still remained a significant tactic deployed globally across this period [5] [6] [7]. A Ukrainian hacking group, Network Battalion 65 (NB65), used ransomware to attack the Russian state-owned television and radio broadcasting network VGTRK. NB65 managed to steal 900,000 emails and 4000 files, and later demanded a ransom which they promised to donate to the Ukrainian army. This attack was unique because the group used the previously leaked source code of Conti, another infamous hacker group that had pledged its support to the Russian government earlier in the conflict. NB65 modified the leaked code to make unique ransomware for each of its targets [5].

Against expectations, Darktrace’s customer base appeared to deviate from these ransom trends. Analysts have seen relatively unsophisticated ransomware attacks during the conflict period, with limited evidence to suggest they were connected to any APT activity. Between November 2021 and June 2022, there were 51 confirmed ransomware compromises across the Darktrace customer base. This represents an increase of 43.16% compared to the same period the year before, accounting for relative customer growth. Whilst this suggests an overall growth in ransom cases, many of these confirmed incidents were unattributed and did not appear to be targeting any particular verticals or regions. While there was an increase in the energy sector, this could not be explicitly linked to the conflict.

The Darktrace DETECT family has a variety of models related to ransomware visibility:

Darktrace Detections for T1486 (Data Encrypted for Impact):

- Compromise / Ransomware / Ransom or Offensive Words Written to SMB

- Compromise / Ransomware / Suspicious SMB Activity

- Anomalous Connection / Sustained MIME Type Conversion

- Unusual Activity / Sustained Anomalous SMB Activity

- Compromise / Ransomware / Suspicious SMB File Extension

- Unusual Activity / Anomalous SMB Read & Write

- Unusual Activity / Anomalous SMB Read & Write from New Device

- SaaS / Resource / SaaS Resources with Additional Extensions

- Compromise / Ransomware / Possible Ransom Note Read

- [If RESPOND is enabled] Antigena / Network / External Threat / Antigena Ransomware Block

Tactic 2: Wipers

One of the largest groups of executables seen during the conflict were wipers. On the eve of the invasion, Ukrainian organizations were targeted by a new wiper malware given the name “HermeticWiper”. Hermetic refers to the name of the Cyprian company “Hermetica Digital Ltd.” which was used by attackers to request a code signing certificate [6]. Such a digital certificate is used to verify the ownership of the code and that it has not been altered. The 24-year-old owner of Hermetica Digital says he had no idea that his company was abused to retrieve a code signing certificate [7].

HermeticWiper consists of three components: a worm, decoy ransomware and the wiper malware. The custom worm designed for HermeticWiper was used to spread the malware across the network of its infected machines. ESET researchers discovered that the decoy ransomware and the wiper were released at the same time [8]. The decoy ransomware was used to make it look like the machine was hit by ransomware, when in reality the wiper was already permanently wiping data from the machines. In the attack’s initial stage, it bypasses Windows security features designed to prevent overwriting boot records by installing a separate driver. After wiping data from the machine, HermeticWiper prevents that data from being re-fragmented and overwrites the files to fragment it further. This is done to make it more challenging to reconstruct data for post-compromise forensics [9]. Overall, the function and purpose of HermeticWiper seems similar to that of NotPetya ransomware.

HermeticWiper is not the only conflict-associated wiper malware which has been observed. In January 2022, Microsoft warned Ukrainian customers that they detected wiper intrusion activity against several European organizations. One example of this was the MBR (Master Boot Record) wiper. This type of wiper overwrites the MBR, the disk sector that instructs a computer on how to load its operating system, with a ransomware note. In reality, the note is a misdirection and the malware destroys the MBR and targeted files [10].

One of the most notable groups that used wiper malware was Sandworm. Sandworm is an APT attributed to Russia’s foreign military intelligence agency, GRU. The group has been active since 2009 and has used a variety of TTPs within their attacks. They have a history of targeting Ukraine including attacks in 2015 on Ukraine’s energy distribution companies and in 2017 when they used the aforementioned NotPetya malware against several Ukrainian organizations [11]. Another Russian (or pro-Russian) group using wiper malware to target Ukraine is DEV-0586. This group targeted various Ukrainian organizations in January 2022 with Whispergate wiper malware. This type of wiper malware presents itself as ransomware by displaying a file instructing the victim to pay Bitcoin to have their files decrypted [12].

Darktrace did not observe any confirmed cases of HermeticWiper nor other conflict-associated wipers (e.g IsaacWiper and CaddyWiper) within the customer base over this period. Despite this, Darktrace DETECT has a variety of models related to wipers and data destruction:

Darktrace Detections for T1485 (Data Destruction)- this is the main technique exploited during wiper attacks

- Unusual Activity / Anomalous SMB Delete Volume

- IaaS / Unusual Activity / Anomalous AWS Resources Deleted

- IaaS / Storage / S3 Bucket Delete

- SaaS / Resource / Mass Email Deletes from Rare Location

- SaaS / Resource / Anomalous SaaS Resources Deleted

- SaaS / Resource / Resource Permanent Delete

- [If RESPOND is enabled] Antigena / Network / Manual / Enforce Pattern of Life

- [If RESPOND is enabled] Antigena / SaaS / Antigena Unusual Activity Block

Tactic 3: Spear-Phishing

Another strategy that some threat actors employ is spear-phishing. Targeting can be done using email, social media, messaging, or other platforms.

The hacking group Armageddon (also known as Gamaredon) has been responsible for several spear-phishing attacks during the crisis, primarily targeting individuals involved in the Ukrainian Government [13]. Since the beginning of the war, the group has been sending out a large volume of emails containing an HTML file which, if opened, downloads and launches a RAR payload. Those who click the attached link download an HTA with a PowerShell script which obtains the final Armageddon payload. Using the same strategy, the group is also targeting governmental agencies in the European Union [14]. With high-value targets, the need to improve teaching around phishing identification to minimize the chance of being caught in an attacker's net is higher than ever.

In comparison to the wider trends, Darktrace analysts again saw little-to-no evidence of conflict-associated phishing campaigns affecting customers. Those phishing attempts which did target customers were largely not conflict-related. In some cases, the conflict was used opportunistically, such as when one customer was targeted with a phishing email referencing Russian bank exclusions from the SWIFT payment system (Figures 1 and 2). The email was identified by Darktrace/Email as a probable attempt at financial extortion and inducement - in this case the company received a spoofed email from a major bank’s remittance department.

Figure 1- Screencap of targeted phishing email sent to Darktrace customer

Figure 2- Attached file contains soliciting reference to SWIFT, a money payment system which select Russian banks were removed from because of the conflict [15]

Although the conflict was used as a reference in some examples, in most of Darktrace’s observed phishing cases during the conflict period there was little-to-no evidence to suggest that the company being targeted nor the threat actor behind the phishing attempt was associated with or attributable to the Russia-Ukraine conflict.

However, Darktrace/Email has several model categories which pick up phishing related threats:

Sample of Darktrace for Email Detections for T1566 (Phishing)- this is the overarching technique exploited during spear-phishing events

Model Categories:

- Inducement

- Internal / External User Spoofing

- Internal / External Domain Spoofing

- Fake Support

- Link to Rare Domains

- Link to File Storage

- Redirect Links

- Anomalous / Malicious Attachments

- Compromised Known Sender

Specific models can be located on the Email Console

Tactic 4: Distributed-Denial-of-Service (DDoS)

Another tactic employed by both pro-Russian and pro-Ukrainian threat actors was DDoS (Distributed Denial of Service) attacks. Both pro-Russia and pro-Ukraine actors were seen targeting critical infrastructure, information resources, and governmental platforms with mass DDoS attacks. The Ukrainian Minister of Digital Transformation, Mykhailo Fedorov, called on an IT Army of underground Ukrainian hackers and volunteers to protect Ukraine's critical infrastructure and conduct DDoS attacks against Russia [16]. As of 1 August 2022, more than two hundred thousand people are subscribed to the group's official Telegram channel, where potential DDoS targets are announced [17].

Darktrace observed similar pro-Ukraine DDoS behaviors within a variety of customer environments. These DDoS campaigns appeared to involve low-volume individual support combined with crowd-sourced DDoS activity. They were hosted on a range of public-sourced DDoS sites and seemed to share sentiments of groups such as the IT Army of Ukraine (Figure 3).

Figure 3- Example DDoS outsource domain with unusual TLD

From the Russian side, one of the prominent newly emerged groups, Killnet, is striking back, launching several massive DDoS attacks against the critical infrastructure of countries that provide weaponry to Ukraine [18 & 19]. Today, the number of supporters of Killnet has grown to eighty-four thousand on their Telegram channel. The group has already launched a number of mass attacks on several NATO states, including Germany, Poland, Italy, Lithuania and Norway. This shows the conflict has attracted new and fast-growing groups with large backing and the capacity to undertake widespread attacks.

DETECT has several models to identify anomalous DoS/DDoS activity:

Darktrace Detection for T1498 (Network Denial of Service)- this is the main technique exploited during DDoS attacks

- Device / Anomaly Indicators / Denial of Service Activity Indicator

- Anomalous Server Activity / Possible Denial of Service Activity

- [If RESPOND is enabled] Antigena / Network / External Threat / Antigena Suspicious Activity Block

What did Darktrace observe?

Darktrace’s cross-fleet detections were largely contrary to expectations. Analysts did not see large-scale complex conflict-linked attacks utilizing either conflict-associated ransomware, malware, or other TTPs. Instead, cyber incidents observed were largely opportunistic, using malware that could be purchased through Malware-as-a-Service models and other widely available toolkits, (rather than APT or conflict-attributable attacks). Overall, this is not to say there have been no repercussions from the conflict or that opportunistic attacks will cease, but evidence suggests that there were fewer wider cyber consequences beyond the initial APT-based attacks seen in the public forum.

Another trend expected since the beginning of the conflict was targeted responses to sanction announcements focusing on NATO businesses and governments. Analysts, however, saw the limited reactive actions, with little-to-no direct impact from sanction announcements. Although cyber-attacks on some NATO organizations did take place, they were not as widespread or impactful as expected. Lastly, it was thought that exposure to new and sophisticated exploits would increase and be used to weaken NATO nations - especially corporations in critical industries. However, analysts observed relatively common exploits deployed indiscriminately and opportunistically. Overall, with the wider industry expecting chaos, Darktrace analysts did not see the crisis taken advantage of to target wider businesses outside of Ukraine. Based on this comparison between expectations and reality, the conflict has demonstrated the danger of falling prey to confirmation bias and the need to remain vigilant and expect the unexpected. It may be possible to say that cyberwar is ‘cold’ right now, however the element of surprise is always present, and it is better to be prepared to protect yourself and your organization.

What to Expect from the Future

As cyberattacks continue to become less monetarily and physically costly, it is to be expected that they will increase in frequency. Even after a political ceasefire is established, hacking groups can harbour resentment and continue their attacks, though possibly on a smaller scale.

Additionally, the longer this conflict continues, the more sophisticated hacking groups’s attacks may become. In one of their publications, Killnet shared with subscribers that they had created ‘network weaponry’ powerful enough to simultaneously take down five European countries (Figure 4) [20]. Whether or not this claim is true, it is vital to be prepared. The European Union and the United States have supported Ukraine since the start of the invasion, and the EU has also stated that it is considering providing further assistance to help Ukraine in cyberspace [21].

Figure 4- Snapshot of Killnet Telegram announcement

How to Protect Against these Attacks

In the face of wider conflict and cybersecurity tensions, it is crucial that organizations evaluate their security stack and practise the following:

· Know what your critical assets are and what software is running on them.

· Keep your software up to date. Prioritize patching critical and high vulnerabilities that allow remote code execution.

· Enforce Multifactor Authentication (MFA) to the greatest extent possible.

· Require the use of a password manager to generate strong and unique passwords for each separate account.

· Backup all the essential files on the cloud and external drives and regularly maintain them.

· Train your employees to recognize phishing emails, suspicious websites, infected links or other abnormalities to prevent successful compromise of email accounts.

In order to prevent an organization from suffering damage due to one of the attacks mentioned above, a full-circle approach is needed. This defence starts with a thorough understanding of the attack surface to provide timely mitigation. This can be supported by Darktrace products:

· As shown throughout this blog, Darktrace DETECT and Darktrace/Email have several models relating to conflict-associated TTPs and attacks. These help to quickly alert security teams and provide visibility of anomalous behaviors.

· Darktrace PREVENT/ASM helps to identify vulnerable external-facing assets. By patching and securing these devices, the risk of exploit is drastically reduced.

· Darktrace RESPOND and RESPOND/Email can make targeted actions to a range of threats such as blocking incoming DDoS connections or locking malicious email links.

‍

Thanks to the Darktrace Threat Intelligence Unit for their contributions to this blog.

‍

Appendices

Reference List

[1] https://www.atlanticcouncil.org/blogs/ukrainealert/vladimir-putins-ukraine-invasion-is-the-worlds-first-full-scale-cyberwar/

[2] https://www.reuters.com/article/us-ukraine-cybersecurity-idUSKCN0VY30K

[3] https://www.reuters.com/article/us-ukraine-cybersecurity-sandworm-idUSKBN0UM00N20160108

[4 & 11] https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/

[5] https://www.scmagazine.com/analysis/ransomware/despite-hopes-for-decline-ransomware-attacks-increased-during-russia-ukraine-conflict

[6] https://ransomware.org/blog/has-the-ukraine-conflict-disrupted-ransomware-attacks/

[7] https://www.cfr.org/blog/financial-incentives-may-explain-perceived-lack-ransomware-russias-latest-assault-ukraine

[8] https://www.bleepingcomputer.com/news/security/hackers-use-contis-leaked-ransomware-to-attack-russian-companies/

[9] https://voi.id/en/technology/138937/hermetica-owner-from-cyprus-didnt-know-his-server-was-used-in-malicious-malware-attack-in-ukraine

[10] https://www.reuters.com/article/ukraine-crisis-cyber-cyprus-idCAKBN2KT2QI

[11] https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-ukraine-hit-by-destructive-attacks-before-and-during-the-russian-invasion-with-hermet/

[12] https://blog.malwarebytes.com/threat-intelligence/2022/03/hermeticwiper-a-detailed-analysis-of-the-destructive-malware-that-targeted-ukraine/

[13] https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

[15] https://www.cisa.gov/uscert/ncas/alerts/aa22-057a

[16] https://attack.mitre.org/groups/G0047/

[17] https://cyware.com/news/ukraine-cert-warns-of-increasing-attacks-by-armageddon-group-850081f8

[18] https://www.bbc.co.uk/news/business-60521822

[19] https://foreignpolicy.com/2022/04/11/russia-cyberwarfare-us-ukraine-volunteer-hackers-it-army/

[20] https://t.me/itarmyofukraine2022

[21] https://www.csoonline.com/article/3664859/russian-ddos-attack-on-lithuania-was-planned-on-telegram-flashpoint-says.html

[19 & 20] https://flashpoint.io/blog/killnet-kaliningrad-and-lithuanias-transport-standoff-with-russia/

[21] https://presidence-francaise.consilium.europa.eu/en/news/member-states-united-in-supporting-ukraine-and-strengthening-the-eu-s-telecommunications-and-cybersecurity-resilience/

Inside the SOC

Written by

Rosa Jong

OSINT Analyst

Written by

Taisiia Garkava

Security Analyst

•

June 11, 2025

Nicole Wong

Cyber Security Analyst

Product Marketing Manager, OT Security & Compliance

Watch the NIS2 Webinar

Blog

Cloud

June 12, 2025

Breaking Silos: Why Unified Security is Critical in Hybrid World

Hybrid environments demand end-to-end visibility to stop modern attacks

Hybrid environments are a dominant trend in enterprise technology, but they continue to present unique issues to the defenders tasked with securing them. By 2026, Gartner predicts that 75% of organizations will adopt hybrid cloud strategies [1]. At the same time, only 23% of organizations report full visibility across cloud environments [2].

That means a strong majority of organizations do not have comprehensive visibility across both their on-premises and cloud networks. As a result, organizations are facing major challenges in achieving visibility and security in hybrid environments. These silos and fragmented security postures become a major problem when considering how attacks can move between different domains, exploiting the gaps.

For example, an attack may start with a phishing email, leading to the compromise of a cloud-based application identity and then moving between the cloud and network to exfiltrate data. Some attack types inherently involve multiple domains, like lateral movement and supply chain attacks, which target both on-premises and cloud networks.

Given this, unified visibility is essential for security teams to reduce blind spots and detect threats across the entire attack surface.

Risks of fragmented visibility

Silos arise due to separate teams and tools managing on-premises and cloud environments. Many teams have a hand in cloud security, with some common ones including security, infrastructure, DevOps, compliance, and end users, and these teams can all use different tools. This fragmentation increases the likelihood of inconsistent policies, duplicate alerts, and missed threats. And that’s just within the cloud, not even considering the additional defenses involved with network security.

Without a unified security strategy, gaps between these infrastructures and the teams which manage them can leave organizations vulnerable to cyber-attacks. The lack of visibility between on-premises and cloud environments contributes to missed threats and delayed incident response. In fact, breaches involving stolen or compromised credentials take an average of 292 to identify and contain [3]. That’s almost ten months.

The risk of fragmented visibility runs especially high as companies undergo cloud migrations. As organizations transition to cloud environments, they still have much of their data in on-premises networks, meaning that maintaining visibility across both on-premises and cloud environments is essential for securing critical assets and ensuring seamless operations.

Unified visibility is the solution

Unified visibility is achieved by having a single-pane-of-glass view to monitor both on-premises and cloud environments. This type of view brings many benefits, including streamlined detection, faster response times, and reduced complexity.

This can only be accomplished through integrations or interactions between the teams and tools involved with both on-premises security and cloud security.

AI-driven platforms, like Darktrace, are especially well equipped to enable the real-time monitoring and insights needed to sustain unified visibility. This is because they can handle the large amounts of data and data types.

Darktrace accomplishes this by plugging into an organization’s infrastructure so the AI can ingest and analyze data and its interactions within the environment to form an understanding of the organization’s normal behavior, right down to the granular details of specific users and devices. The system continually revises its understanding about what is normal based on evolving evidence.

This dynamic understanding of normal means that the AI engine can identify, with a high degree of precision, events or behaviors that are both anomalous and unlikely to be benign. This helps reduce noise while surfacing real threats, across cloud and on-prem environments without manual tuning.

In this way, given its versatile AI-based, platform approach, Darktrace empowers security teams with real-time monitoring and insights across both the network and cloud.

Unified visibility in the modern threat landscape

As part of the Darktrace ActiveAI Security Platform™, Darktrace / CLOUD works continuously across public, private, hybrid, and multi-cloud deployments. With real-time Cloud Asset Enumeration and Dynamic Architecture Modeling, Darktrace / CLOUD generates up-to-date architecture diagrams, giving SecOps and DevOps teams a unified view of cloud infrastructures.

It is always on the lookout for changes, driven by user and service activity. For example, unusual user activity can significantly raise the asset’s score, prompting Darktrace’s AI to update its architectural view and keep a living record of the cloud’s ever-changing landscape, providing near real-time insights into what’s happening.

This continuous architectural awareness ensures that security teams have a real-time understanding of cloud behavior and not just a static snapshot.

*Figure 1. Darktrace / CLOUD’s unified view of AWS and Azure cloud posture and compliance over time.*

With this dynamic cloud visibility and monitoring, Darktrace / CLOUD can help unify and secure environments.

Real world example: Remote access supply chain attacks

Sectop Remote Access Trojan (RAT) malware, also known as ‘ArchClient2,’ is a .NET RAT that contains information stealing capabilities and allows threat actors to monitor and control targeted computers. It is commonly distributed through drive-by downloads of illegitimate software via malvertizing.

Darktrace has been able to detect and respond to Sectop RAT attacks using unified visibility and platform-wide coverage. In one such example, Darktrace observed one device making various suspicious connections to unusual endpoints, likely in an attempt to receive C2 information, perform beaconing activity, and exfiltrate data to the cloud.

This type of supply chain attack can jump from the network to the cloud, so a unified view of both environments helps shorten detection and response times, therefore mitigating potential impact. Darktrace’s ability to detect these cross-domain behaviors stems from its AI-driven, platform-native visibility.

Conclusion

Organizations need unified visibility to secure complex, hybrid environments effectively against threats and attacks. To achieve this type of comprehensive visibility, the gaps between legacy security tools across on-premises and cloud networks can be bridged with platform tools that use AI to boost data analysis for highly accurate behavioral prediction and anomaly detection.

Read more about the latest trends in cloud security in the blog “Protecting Your Hybrid Cloud: The Future of Cloud Security in 2025 and Beyond.”

References:

1. Gartner, May 22, 2023, “10 Strategic Data and Analytics Predictions Through 2028”

2. Cloud Security Alliance, February 14, 2024, “Cloud Security Alliance Survey Finds 77% of Respondents Feel Unprepared to Deal with Security Threats”

3. IBM, “Cost of a Data Breach Report 2024”

About the author

Pallavi Singh

Product Marketing Manager, OT Security & Compliance

Blog

OT

June 11, 2025

Proactive OT security: Lessons on supply chain risk management from a rogue Raspberry Pi

Understanding supply chain risk in manufacturing

For industries running Industrial Control Systems (ICS) such as manufacturing and fast-moving consumer goods (FMCG), complex supply chains mean that disruption to one weak node can have serious impacts to the entire ecosystem. However, supply chain risk does not always originate from outside an organization’s ICS network.

The implicit trust placed on software or shared services for maintenance within an ICS can be considered a type of insider threat [1], where defenders also need to look ‘from within’ to protect against supply chain risk. Attackers have frequently mobilised this form of insider threat:

Many ICS and SCADA systems were compromised during the 2014 Havex Watering Hole attack, where via operators’ implicit trust in the trojanized versions of legitimate applications, on legitimate but compromised websites [2]. ‍
In 2018, the world’s largest manufacturer of semiconductors and processers shut down production for three days after a supplier installed tainted software that spread to over 10,000 machines in the manufacturer’s network [3].
During the 2020 SolarWinds supply chain attack, attackers compromised a version of Orion software that was deployed from SolarWinds’ own servers during a software update to thousands of customers, including tech manufacturing companies such as Intel and Nvidia [4].

Traditional approaches to ICS security have focused on defending against everything from outside the castle walls, or outside of the ICS network. As ICS attacks become more sophisticated, defenders must not solely rely on static perimeter defenses and prevention.

A critical part of active defense is understanding the ICS environment and how it operates, including all possible attack paths to the ICS including network connections, remote access points, the movement of data across zones and conduits and access from mobile devices. For instance, original equipment manufacturers (OEMs) and vendors often install remote access software or third-party equipment in ICS networks to facilitate legitimate maintenance and support activities, which can unintentionally expand the ICS’ attack surface.

This blog describes an example of the convergence between supply chain risk and insider risk, when a vendor left a Raspberry Pi device in a manufacturing customer’s ICS network without the customer’s knowledge.

Case study: Using unsupervised machine learning to detect pre-existing security issues

Raspberry Pi devices are commonly used in SCADA environments as low-cost, remotely accessible data collectors [5][6][7]. They are often paired with Industrial Internet of Things (IIoT) for monitoring and tracking [8]. However, these devices also represent a security risk because their small physical size and time-consuming nature of physical inspection makes them easy to overlook. This poses a security risk, as these devices have previously been used to carry out USB-based attacks or to emulate Ethernet-over-USB connections to exfiltrate sensitive data [8][9].

In this incident, a Darktrace customer was unaware that their supplier had installed a Raspberry Pi device on their ICS network. Crucially, the installation occurred prior to Darktrace’s deployment on the customer’s network.

For other anomaly detection tools, this order of events meant that this third-party device would likely have been treated as part of the customer’s existing infrastructure. However, after Darktrace was deployed, it analyzed the metadata from the encrypted HTTPS and DNS connections that the Raspberry Pi made to ‘call home’ to the supplier and determined that these connections were unusual compared to the rest of the devices in the network, even in the absence of any malicious indicators of compromise (IoCs).

Darktrace triggered the following alerts for this unusual activity that consequently notified the customer to the pre-existing threat of an unmanaged device already present in their network:

Compromise / Sustained SSL or HTTP Increase
Compromise / Agent Beacon (Short Period)
Compromise / Agent Beacon (Medium Period)
Compromise / Agent Beacon (Long Period)
Tags / New Raspberry Pi Device
Device / DNS Requests to Unusual Server
Device / Anomaly Indicators / Spike in Connections to Rare Endpoint Indicator

‍*Figure 1: Darktrace’s External Sites Summary showing the rarity of the external endpoint that the Raspberry Pi device ‘called home’ to and the model alerts triggered.*

Darktrace’s Cyber AI Analyst launched an autonomous investigation into the activity, correlating related events into a broader incident and generating a report outlining the potential threat along with supporting technical details.

Darktrace’s anomaly-based detection meant that the Raspberry Pi device did not need to be observed performing clearly malicious behavior to alert the customer to the security risk, and neither can defenders afford to wait for such escalation.

Why is this significant?

In 2021 a similar attack took place. Aiming to poison a Florida water treatment facility, attackers leveraged a TeamViewer instance that had been dormant on the system for six months, effectively allowing the attacker to ‘live off the land’ [10].

The Raspberry Pi device in this incident also remained outside the purview of the customer’s security team at first. It could have been leveraged by a persistent attacker to pivot within the internal network and communicate externally.

A proactive approach to active defense that seeks to minimize and continuously monitor the attack surface and network is crucial.

The growing interest in manufacturing from attackers and policymakers

Significant motivations for targeting the manufacturing sector and increasing regulatory demands make the convergence of supply chain risk, insider risk, and the prevalence of stealthy living-off-the-land techniques particularly relevant to this sector.

Manufacturing is consistently targeted by cybercriminals [11], and the sector’s ‘just-in-time’ model grants attackers the opportunity for high levels of disruption. Furthermore, under NIS 2, manufacturing and some food and beverage processing entities are now designated as ‘important’ entities. This means stricter incident reporting requirements within 24 hours of detection, and enhanced security requirements such as the implementation of zero trust and network segmentation policies, as well as measures to improve supply chain resilience [12][13][14].

How can Darktrace help?

Ultimately, Darktrace successfully assisted a manufacturing organization in detecting a potentially disruptive 'near-miss' within their OT environment, even in the absence of traditional IoCs. Through passive asset identification techniques and continuous network monitoring, the customer improved their understanding of their network and supply chain risk.

While the swift detection of the rogue device allowed the threat to be identified before it could escalate, the customer could have reduced their time to respond by using Darktrace’s built-in response capabilities, had Darktrace’s Autonomous Response capability been enabled. Darktrace’s Autonomous Response can be configured to target specific connections on a rogue device either automatically upon detection or following manual approval from the security team, to stop it communicating with other devices in the network while allowing other approved devices to continue operating. Furthermore, the exportable report generated by Cyber AI Analyst helps security teams to meet NIS 2’s enhanced reporting requirements.

Sophisticated ICS attacks often leverage insider access to perform in-depth reconnaissance for the development of tailored malware capabilities. This case study and high-profile ICS attacks highlight the importance of mitigating supply chain risk in a similar way to insider risk. As ICS networks adapt to the introduction of IIoT, remote working and the increased convergence between IT and OT, it is important to ensure the approach to secure against these threats is compatible with the dynamic nature of the network.

Credit to Nicole Wong (Principal Cyber Analyst), Matthew Redrup (Senior Analyst and ANZ Team Lead)

Appendices

MITRE ATT&CK Mapping

Infrastructure / New Raspberry Pi Device - INITIAL ACCESS - T1200 Hardware Additions
Device / DNS Requests to Unusual Server - CREDENTIAL ACCESS, COLLECTION - T1557 Man-in-the-Middle
Compromise / Agent Beacon - COMMAND AND CONTROL - T1071.001 Web Protocols