{"id":59818,"date":"2025-09-26T10:54:24","date_gmt":"2025-09-26T10:54:24","guid":{"rendered":"https:\/\/becolve.com\/blog\/enisa-threat-landscape-report-2018-some-notes-on-scada-ics-systems-and-critical-infrastructures\/"},"modified":"2025-09-26T10:54:24","modified_gmt":"2025-09-26T10:54:24","slug":"enisa-threat-landscape-report-2018-some-notes-on-scada-ics-systems-and-critical-infrastructures","status":"publish","type":"blog","link":"https:\/\/becolve.com\/en\/blog\/enisa-threat-landscape-report-2018-some-notes-on-scada-ics-systems-and-critical-infrastructures\/","title":{"rendered":"ENISA Threat Landscape Report 2018. Some notes on SCADA\/ICS systems and critical infrastructures."},"content":{"rendered":"

Yesterday, Monday, January 28, 2018, ENISA<\/strong><\/a> published its annual threat report: the ENISA Threat Landscape Report 2018 – 15 Top Cyberthreats and Trends<\/em>, which you can download at this link<\/a>.<\/p>\n

As usual, the report incorporates essential information and data for anyone who wants to stay abreast of current and future threats that affect, I would say, any type of organization.<\/p>\n

In the following figure, you can see the main threats that have emerged during 2018 and their position with respect to those detected during 2017.<\/p>\n

\"\"<\/p>\n

Additionally, in this entry, we would like to point out some of the most important data collected in the report related to SCADA\/ICS<\/strong> systems and critical infrastructures.<\/p>\n

Malware in SCADA\/ICS environments<\/strong><\/p>\n

In point 3.1 of the report, it is highlighted how during the past year the malware Triton, <\/a>was the first to affect the SIS (Safety Instrumented Systems), that is, the systems that allow executing “specific control functions”, when the process has entered conditions that can seriously affect the safety of workers or cause serious environmental incidents.<\/p>\n

In addition, the report indicates that, in the coming years, operating environments and critical infrastructures in general will be a priority target for APT groups.<\/p>\n

Similarly, within this malware section, the existence of a specific type of malware, Cryptojacking, appears for the first time as a threat. That is, it is a malware that infects OT systems and devices, allowing the malicious user to mine cryptocurrency. In OT environments, this type of malware can generate a significant degradation in system performance. <\/p>\n

The report mentions the incident suffered by critical infrastructure in the water sector in February 2018, using said malware. As can be seen in the following figure from the report, attacks on critical infrastructures through “Cryptomining malware” are increasing sharply in recent months. <\/p>\n

\"\"<\/p>\n

Attack vectors in SCADA\/ICS environments<\/strong><\/p>\n

In section 5 of the report, \u201cAttack Vectors\u201d, mention is made of the so-called \u201cMulti-staged and Modular Threats\u201d, that is, those attacks that are carried out by groups that use very sophisticated, versatile and persistent malware. Some of the examples indicated are VPNFilter, BlackEnergy or CobInt, and these are their characteristics: self-propagation, self-destruction, hidden communications with the C2, persistent behaviors, obfuscation at the origin, etc. <\/p>\n

The report provides a brief overview of the characteristics of the first VPNFilter, a malware that affected more than 500,000 network electronics devices. The following figure shows the stages followed by this malware to perpetrate its malicious actions. <\/p>\n

\"\"<\/p>\n

Among the specific actions of this malware, it is worth noting that two “pluging modules” were found:<\/p>\n