卡巴斯基实验室：2023上半年工业自动化系统威胁报告 Threat landscape for industrial automation systems - Statistics for H1 2023

Threatlandscape

forindustrialautomation

systems

StatisticsforH12023

KasperskyICSCERT

13.09.2023Version1.0

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.1

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Mid-yearhighlights 2

Figures 2

Allthreats 2

Categoriesofmaliciousobjects 2

Mainthreatsources 2

Goodnews 2

Rankingswhereregionsthatdobestweredoingworst 3

Globalthreatstatistics 8

Regions 9

Countries 11

Individualindustries 12

Thevarietyofmalwaredetected 13

Categoriesofmaliciousobjects 14

Maliciousscriptsandphishingpages(JSandHTML) 15

Denylistedinternetresources 16

Spyware 17

Maliciousdocuments(MSOffice+PDF) 18

Maliciouscryptocurrencyminers 19

Virusesandworms 21

Ransomware 23

MalwareforAutoCAD 24

Mainthreatsources 25

World 25

Regionsandcountries 26

Internet 26

Emailclients 27

Removabledevices 28

Networkfolders 29

Methodologyusedtopreparestatistics 31

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.2

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Mid-yearhighlights

Figures

Allthreats

•Inthefirsthalfof2023,maliciousobjects(alltypesofthreats)wereblockedon34%ofICScomputers.Thiswas0.3pplessthaninthesecondhalfof2022.

•Inthesecondquarterof2023,thispercentagereachedthehighestquarterlylevelgloballysince2022,26.8%.

•Thefigurevariedbetween40.3%inAfricaand14.7%inNorthernEuropebyregion,and

•between53.3%inEthiopiaand7.4%inLuxembourgbycountry.

Categoriesofmaliciousobjects

•Maliciousscriptsandphishingpageswereblockedon12.7%ofICScomputers

•Denylistedinternetresources,on11.3%

•Spyware,on6%

•Maliciousdocuments,on4%

•Ransomware,on0.32%.Thisisthelowestpercentagesincethebeginningof2020.

Mainthreatsources

•Theinternetwasthesourceofthreatsblockedon19.3%ofICScomputers.

•Emailclients–6%

•Removabledevices–3.4%

Goodnews

H12022sawanoticeableincreaseinthepercentageofICScomputersonwhichthefollowingthreatswereblocked:

•Spyware

•Maliciousdocuments

•MaliciousminersintheformofWindowsexecutables

•Ransomware

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.3

STATISTICSFORH12023©2023AOKASPERSKYLAB.

PercentageofICScomputersonwhich

theactivity

ofmalicious

objects

ofvarious

categories

wasprevented

Thatwasthebadnews.Herecomesthegoodnews.ThepercentagesofICS

computersonwhichallthesethreatcategorieswereblockedhadbeendecliningsincemid-2022.

InH12023,thepercentageofICScomputersonwhichthesecategoriesof

threatswereblocked,droppedinvirtuallyeveryregion.Afewunlikelyexceptionstothiswillbedealtwithbelow.

Rankingswhereregionsthatdobestweredoingworst

AustraliaandNewZealand,theUnitedStatesandCanada,WesternEurope,andNorthernEuropehistoricallyhavehadthelowestpercentagesofICScomputersonwhichmaliciousobjectsareblocked.

H12023

changesinthepercentagesofICScomputersonwhich

malicious

objectswere

blocked,

byregion

InH12023,however,thoseweretheveryregionswherethepercentagesofattackedICScomputersincreasedbythemostpercentagepoints.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.4

STATISTICSFORH12023©2023AOKASPERSKYLAB.

AustraliaandNewZealandseethisfigurevaryfromhalf-yeartohalf-year,anditdidnotexceedpreviousperiods'valuesinH12023.

InNorthernEurope,andtheUnitedStatesandCanada,werecordedanupwardtrendinthepercentageofattackedICScomputers.

InWesternEurope,thepercentageofcomputersonwhichmaliciousobjects

wereblockeddeclinedin2022beforespikinginH12023toexceedtheprevioustwoyears'figures.

Percentageof

ICScomputers

onwhich

malicious

objectswere

blocked

inselected

regions

Letusanticipateaquestionbysayingthatdespitetheincreaseinthe

percentageofattackedcomputers,theseregionsretainedaminimalpercentagebyvirtuallyeverycriterion.

Asforthehalf-yearincrease,theseregionsdidtopmanylistsinH12023.

Blockeddenylistedinternetresources,andmaliciousscriptsandphishingpageswerethebiggestcontributorstothisincreaseinthehistoricallysaferregions.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.5

STATISTICSFORH12023©2023AOKASPERSKYLAB.

H12023

changesinthepercentagesofICScomputersonwhich

denylisted

internet

resourceswereblocked,

byregion

H12023

changesinthepercentagesof

ICScomputersonwhich

malicious

scriptsand

phishingpageswereblocked,byregion

Boththreattypesspreadviatheinternet,whilemaliciousscriptsandphishing

pagesalsospreadviaemail.ThepercentageofICScomputersonwhichthreatsfromthesetwosourceswereblockedintheUnitedStatesandCanada,and

WesternEuropealsoincreasedthemostamongallregions.

Thesearenottheonlybadliststheseregionstopped.TheUnitedStatesand

Canada,NorthernEurope,andAustraliaandNewZealandsawthelargestgrowthinthepercentageofcomputersonwhichspywarewasblocked.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.6

STATISTICSFORH12023©2023AOKASPERSKYLAB.

H12023

changesinthepercentagesofICScomputersonwhich

spywarewas

blocked,

byregion

H12023

changesinthepercentagesofICScomputersonwhich

ransomware

wasblocked,

byregion

NotethatthepercentageofICScomputersattackedbyransomwareinH12023increasedinfourregionsincludingAustraliaandNewZealand,andtheUnited

StatesandCanada,bytherelativelysignificantrespectivevaluesof0.19ppand0.13pp,andinNorthernEurope.

Thepercentagesofcomputersonwhichvirusesandwormswereblockedwere

similarlyunexpected.ThefiveregionswherethesefiguresincreasedthemostweretheUnitedStatesandCanada,NorthernEurope,AustraliaandNew

Zealand,andWesternEurope.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.7

STATISTICSFORH12023©2023AOKASPERSKYLAB.

H12023

changesinthepercentagesofICScomputersonwhich

viruseswere

blocked,

byregion

H12023

changesinthepercentagesofICScomputersonwhichwormswereblocked,

byregion

AustraliaandNewZealandsawanincreaseinthenumberofcomputersonwhichthreatswereblockedafterremovabledeviceswereconnected.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.8

STATISTICSFORH12023©2023AOKASPERSKYLAB.

H12023

changesinthe

percentagesof

ICScomputers

onwhich

threatswere

blockedafter

removable

deviceswere

connected,

byregion

Globalthreatstatistics

PercentageofICScomputersonwhich

malicious

objectswere

blocked,

byhalfyear

Inthefirsthalfof2023,thepercentageofICScomputersonwhichmaliciousobjectswereblockeddecreasedfromH22022byjust0.3ppto34%.

Thatsaid,thepercentageofattackedICScomputersdroppedinQ12023,butthenroseagaininQ22023,reachinghighestquarterlyfiguresince2022.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.9

STATISTICSFORH12023©2023AOKASPERSKYLAB.

PercentageofICScomputersonwhich

malicious

objectswere

blocked,

byquarter

PercentageofICScomputers

onwhich

malicious

objectswere

blocked,

January-June2023

Regions

PercentageofICScomputersonwhich

malicious

objectswere

blocked,

byregions

Inspring(MarchthroughMay),thepercentageofICScomputersonwhich

maliciousobjectswereblockedremainedhigherthanintheotherthreemonths.

Thepercentageofcomputersonwhichmaliciousactivitywaspreventedvariedacrossregionsfrom40.3%inAfricato14.7%inNorthernEurope.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.10

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Youmayrememberthatintheprevioushalf-year,thepercentageofICS

computersinRussiaandCentralAsiaonwhichmaliciousobjectswereblocked

increasednoticeablyduetomassinfectionofwebsites,includingthoserunby

industrialcompanies,thatusedanoutdatedversionofapopularRussianCMS.InH12023,thefiguresinbothregionsreturnedtovaluesclosetothoseofH12022.

Asmentionedabove,themostsignificantincreasesinthepercentageofICScomputersonwhichmaliciousobjectswereblockedwererecordedinWesternEurope(4.6pp),theUnitedStatesandCanada(1.9pp),aswellasAustraliaandNewZealand(1.3pp).Notetheminorbutsteadygrowthinthatpercentagein

NorthernEuropeandtheMiddleEast(by0.3ppeach).

WesternEurope,whichrecordedthelargestincreaseamongallregions,sawthepercentageofattackedICScomputersinH12023groweverymonthuptoMay,andthendroptoJanuary'slevelinJune.

Western

Europe.

Percentageof

ICScomputers

onwhich

malicious

objectswere

blocked,

January-June

2023

OurdataindicatesthatinH12023,somethreatactorsreinventedanoldphishing

techniquethatwasfirstseenbackin2010totargetorganizationsinEurope,

includingindustrialones.Thetechniqueinvolvesinfectingawebsitewitha

maliciousscriptthattriggersapop-upwindowresemblingaMicrosofttech

supportwindow.Thepop-updoesnotcontainanylinks,butinsteadpresentsaphishingmessageandalocalphonenumbertocall.Whenausercallsthe

number,athreatactoranswersthecallandcommunicatesinthelocallanguage,manipulatingtheunsuspectingusertodownloadandinstallaremoteaccesstool

orapieceofmultifunctionalspyware.Thistechniqueleveragessocial

engineeringtacticstodeceiveusersandgainunauthorizedaccesstotheirsystems,posingaseriousthreattoorganizations,includingindustrialones.

TheindustriesunderreviewinthatregionthatsawthepercentagesincreasethemostwereengineeringandICSintegration(by6.1pp).

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.11

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Western

Europe.

PercentageofICScomputers

onwhich

malicious

objectswere

blockedin

selected

industries

PercentageofICScomputersonwhich

malicious

objectswere

blockedin

Africaand

regionsofAsia

Countries

MostoftheregionswherethepercentageofattackedcomputersincreasedinH12023(NorthernandWesternEurope,theUnitedStatesandCanada,and

AustraliaandNewZealand)areusuallyatthebottomofthelist.AfricaandtheAsianregionswherethepercentageofICScomputersonwhichmalicious

objectsareblockedhistoricallyhasbeenhigh,showedadownwardtrend.

ThepercentageofICScomputersonwhichmaliciousobjectswereblockedvariedacrosscountriesfrom53.3%inEthiopiato7.4%inLuxembourg.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.12

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Fifteen

countriesandterritorieswiththehighest

percentageofICScomputersonwhich

malicious

objectswere

blocked,

H12023

TencountriesandterritorieswiththelowestpercentageofICScomputersonwhich

malicious

objectswere

blocked,

H12023

SevenAfrican,threeMiddleEasternandthreeCentralAsiancountrieswereamongthefifteencountriesandterritoriesinH12023withthehighest

percentageofICScomputersonwhichmaliciousobjectswereblocked.

Halfofthe10countriesthathadthelowestfigureswerelocatedinNorthernEurope.

Individualindustries

InH12023,thepercentageofICScomputersonwhichmaliciousobjectswereblockedincreasedinengineeringandICSintegration(by2pp),manufacture(by1.9pp)andenergy(by1.5pp).

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.13

STATISTICSFORH12023©2023AOKASPERSKYLAB.

PercentageofICScomputersonwhich

malicious

objectswere

blockedin

selected

industries

PercentageofICScomputersonwhich

malicious

objectswere

blockedin

selected

industries

Buildingautomationisstilltheleaderamongtheindustriesunderreview.

EnergyandoilandgashaveseenoppositetrendsinthepercentageofICScomputersonwhichmaliciousobjectswereblockedsince2021.

Thevarietyofmalwaredetected

InH12023,Kasperskysecuritysolutionsblocked11,727differentmalwarefamiliesinindustrialautomationsystems.

Malware

familiesblocked

onICS

computers

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.14

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Categoriesofmaliciousobjects

MaliciousobjectsthatKasperskyproductsblockonICScomputersfallunder

manycategories.Abriefdescriptionofeachtypeofthreatisprovidedin

aseparatedocument.

PercentageofICS*computersonwhichtheactivityofmaliciousobjectsofvariouscategorieswasprevented

*Inmanycases,twoormoretypesofthreatsmayhavebeenblockedonasinglecomputerduringthereportingperiod.Therefore,theresultingpercentages

shouldnotbeaddedtogether.

OnlyoneofthecategoriesgrewinH12023:denylistedinternetresources.ThepercentageofICScomputersonwhichthreatsinthiscategoryareblockedhasgrownforthesecondhalf-yearinarow.

Until2022,denylistedinternetresourceshadtoppedthelistofthreat

categories,butin2022,theytooksecondplacetomaliciousscriptsandphishingpages,whichstillremainatthetopofthelist.Yet,thevaluesforthesetwotypesofthreatswereconverging.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.15

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Percentageof

ICScomputers

onwhich

malicious

scriptsand

phishingpages,

anddenylisted

internet

resourceswere

blocked

Maliciousscriptsandphishingpages(JSandHTML)

Maliciousscriptsandphishingpages(JSandHTML)spreadviaboththeinternetandemail.Asignificantpartofdenylistedinternetresourcesareusedtospreadmaliciousscriptsandphishingpages.

Maliciousscriptsserveabroadrangeofgoals:fromcollectingdata,trackingandforwardinguserstomaliciouswebsites,todownloadingvariousmalware,suchasspywareand/orcovertcryptominers,tothesystemorthebrowser.

TheregionswiththehighestpercentageofICScomputersonwhichmaliciousscriptsandphishingpageswereblockedweretheMiddleEastandRussia.Thefigureincreasedinfiveregionsoverthehalf-year,mostlyintheUnitedStatesandCanada(by3.3pp),WesternEurope(by2.2pp),andAustraliaandNew

Zealand(by1.9pp).

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.16

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Regionsrankedbypercentage

ofICS

computersonwhichmaliciousscriptsand

phishingpageswereblocked,H12023

ThecountrieswiththehighestpercentageofICScomputersonwhichmaliciousscriptsandphishingpageswereblockedwereKyrgyzstan(21%)andAfghanistan(20.9%).

Denylistedinternetresources

AfricawastheregionwiththehighestpercentageofICScomputersonwhichdenylistedinternetresourceswereblocked.Notsurprisingly,AfricaalsohadthehighestpercentageofICScomputersonwhichthreatsthatoriginatedonthe

internetwereblocked(seebelowunder"Mainthreatsources").

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.17

STATISTICSFORH12023©2023AOKASPERSKYLAB.

RegionsrankedbypercentageofICS

computerson

which

denylisted

internet

resourceswereblocked,

H12023

Spyware

PercentageofICScomputersonwhich

spywarewas

blocked

Asmentionedabove,denylistedinternetresourcesweretheonlythreat

categorywherethepercentageofICScomputersonwhichthethreatwas

blockedincreasedworldwide.Thisfiguregrewinmostregionsduringthehalf-year,withthelargestincreasesrecordedintheUnitedStatesandCanada(3.2pp),EasternEurope(2.6pp),andAustraliaandNewZealand(2.5pp).

ThecountrieswiththehighestpercentageofICScomputersonwhich

denylistedinternetresourceswereblockedwereAlgiers(21.8%)andAfghanistan(20.2%).

ThepercentageofICScomputersonwhichspywareisblockedcontinuedtodecline.Earlier,wesawthefigurerisefrom2020throughH12022.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.18

STATISTICSFORH12023©2023AOKASPERSKYLAB.

AfricahadthehighestpercentageofICScomputersonwhichspywarewasblockedinH12023.TheMiddleEastandSoutheastAsiahadsimilarlyhigh

percentages.

Regionsranked

bypercentage

ofICS

computerson

whichspyware

wasblockedin

H12023

TheleadersamongcountriesandterritorieswereTajikistan(18.9%),Algiers(16.7%)andAfghanistan(16.6%).

Maliciousdocuments(MSOffice+PDF)

PercentageofICScomputersonwhich

malicious

documents

wereblocked

Hackersspreadmaliciousdocumentsviaphishingmessagesandusethemin

attackswhichaimforprimaryinfection.TheglobalpercentageofICScomputersonwhichthreatsinthiscategorywereblockedmorethandoubledinH12022andhaddeclinedsince.YetinH12023,itremainedhigherthanin2020–2021.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.19

STATISTICSFORH12023©2023AOKASPERSKYLAB.

RegionsrankedbypercentageofICS

computersonwhichmaliciousdocuments

wereblocked,H12023

TheregionswiththehighestfigureswereLatinAmericaandSouthernEurope.TheseregionsalsohadthehighestpercentagesofICScomputersonwhich

emailthreatswereblocked.

TheUnitedStatesandCanadasawthelargestincrease(by0.72pp)inthepercentageofcomputersonwhichmaliciousdocumentswereblocked.

ThecountrieswiththehighestpercentageofICScomputersonwhichmaliciousdocumentswereblockedwereAlgiers(16.7%)andAfghanistan(16.6%).

Maliciouscryptocurrencyminers

Minersoftenspreadviawebsitestowhichusersareredirectedwiththehelpofmaliciousscriptsthathackersdeployonvariousmediaandpiratingsites.

TheglobalpercentageofICScomputersonwhichmaliciousminers(bothWindowsexecutablesandwebminers)wereblockeddecreasedinH12023.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.20

STATISTICSFORH12023©2023AOKASPERSKYLAB.

PercentageofICScomputersonwhich

malicious

programsforcovertcryptominingwere

blocked

Regionsrankedbypercentage

ofICS

computerson

whichminers-executablefileswereblocked

inH12023

CentralAsiawastheregionwiththehighestpercentageofICScomputerson

whichminers–WindowsexecutablefileswereblockedinH12023.Thecountries

andterritorieswiththehighestpercentagewereTajikistan(7.9%)and

Turkmenistan(7.4%).

Africawastheleaderamongregionsbypercentageofcomputersonwhichweb

minerswereblocked.Russia,andtheUnitedStatesandCanadasawthe

percentageincreaseoverthehalf-year,by0.13ppand0.12pp,respectively.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.21

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Regionsrankedbypercentage

ofICS

computersonwhichweb

minersrunninginbrowsers

wereblocked

inH12023

Serbiawastheleaderamongthecountriesandterritorieswiththehighest

percentageofICScomputersonwhichwebminerswereblocked,with6.4%.

Virusesandworms

ThepercentageofICScomputersonwhichwormswereblockedcontinuedtodecrease.Webelievethisisanindirectindicationofthesystematicuseof

securitysolutionsinOTenvironments,whicheliminatesinfectionhotspotsandpreventsthespreadofself-propagatingmalware.

ThepercentageofICScomputersonwhichviruseswereblockeddidnotchangeinH12023.

Percentageof

ICScomputers

onwhich

virusesand

wormswere

blocked

VirusesandwormsspreadacrossICSnetworksbymeansofremovablemedia,

sharedfolders,infectedfiles,suchasbackups,andnetworkattacksonoutdatedsoftware,suchasRadmin2.

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.22

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Manyvirusesandwormsstillcirculatingareold,andtheircommand-and-controlservershavelongbeenshutdown.Besidesunderminingthesecurityofinfectedsystems,forexample,byopeningnetworkportsandchangingsettings,these

olderwormsandvirusescanpotentiallycausesoftwaretoquitunexpectedlyorcreatedenial-of-serviceconditions.

Newerwormvarieties,whichmaliciousactorsusetospreadspyware,

ransomwareandminers,canbefoundonICSnetworksaswell.Inmostcases,thesewormsspreadbyexploitingvulnerabilitiesinnetworkservices(suchasSMBandRDP)thathavebeenfixedbyvendorsbutarestillunpatchedonOTnetworks,usingpreviouslystolenauthenticationcredentialsorbruteforcingpasswords.

ThepercentageofICScomputersonwhichwormsweredetectedwasstillveryhighinAfrica,makingthatregiontheleaderbypercentageofICScomputersonwhichthreatswereblockedafterremovabledeviceswereconnected.The

UnitedStatesandCanada,andNorthernEuropesawthelargestincreasesduringthehalf-year,by0.53ppand0.45pp,respectively.

Regionsranked

bypercentage

ofICS

computerson

whichworms

wereblocked

inH12023

ThehighestpercentageofICScomputersonwhichwormsweredetectedwasrecordedinMali(20.8%).NotethatTurkmenistan(18%)wasamongthefive

countrieswiththehighestfiguresalongsideAfricancountries.

ThevirusissueremainedrelevantforSoutheastAsia.ThepercentageofICScomputersonwhichviruseswereblockedgrewinmanyregions,mostlytheUnitedStatesandCanada(by0.49pp),andNorthernEurope(by0.44pp).

THREATLANDSCAPEFORINDUSTRIALAUTOMATIONSYSTEMS.23

STATISTICSFORH12023©2023AOKASPERSKYLAB.

Regionsrankedbypercentage

ofICS

computersonwhichviruseswereblockedinH12023

Afghanistan(16.6%),Vietnam(14.1%)andYemen(13.8%)wereamongthe

countriesandterritorieswiththehighestpercentageofICScomputersonwhichviruseswereblocked.

Ransomware

PercentageofICScomputersonwhich

ransomware

wasblocked

AfterthepercentageofICScomputersonwhichransomwarewasblockedincreasedinH12022,itdroppedtothelowestlevelsince2020inH12023.

EastAsiaandtheMiddleEastwe