2018上半年工业自动化系统威胁报告.pdfVIP

Threat Landscape for Industrial Automation Systems H1 2018 06.09.2018 Version 1.0 Kaspersky Lab ICS CERT Contents H1 2018 – Key events 3 Spectre and Meltdown vulnerabilities in industrial solutions 3 Energetic Bear/Crouching Yeti: attacks on servers3 Cryptominers in industrial networks 4 Large-scale attacks on Cisco switches affect critical infrastructure objects 5 New VPNFilter malware with SCADA monitoring function 5 Attack on satellite systems 6 Key research: details on Triton malware 6 IoT botnet activity 6 Ransomware attacks 7 Attacks on industrial enterprises using RATs 7 RMS and TeamViewer-based phishing attacks 7 Attacks using RATs in a company's industrial network 8 Threat statistics 9 Methodology 9 Percentage of ICS computers attacked10 Geographical distribution 10 Factors affecting the cybersecurity of ICS computers12 Main sources of infection 15 Main sources of ICS computer infections by region 16 Internet 16 Removable media 17 Email clients 19 Malware on industrial automation systems 21 Platforms used by malware 21 Exploits 22 Spyware 23 Our recommendations 24 THREAT LANDSCAPE FOR INDUSTRIAL AUTOMATION 1 SYSTEMS, H1 2018 © KASPERSKY LAB, 1997 – 2018 Kaspersky Lab ICS CERT For many years, Kaspersky Lab experts have been uncovering and researching cyberthreats that target a variety of information systems – those of commercial and government organizations, banks, telecoms operators, industrial enterprises, and individual users. In this report, Kaspersky Lab Industrial Control Systems Cyber Emergency Response Team (Kaspersky Lab ICS CERT) publ