Dragonfly 2.0 mapping on MITRE ATT&CK ICS Matrix

Posted on 21/03/2024, by
INCIBE (INCIBE)
Decorative image
Currently, industrial infrastructures are suffering more attacks than ever before, and it is expected that attacks on these types of infrastructures will continue to grow exponentially in the coming years. This is why, throughout this article, an analysis will be made of a group of cybercriminals and their standard attack, showing how information can be obtained on the modus operandi, when and by what tactics and techniques they managed to attack an industrial infrastructure

LockBit: response and recovery actions

Posted on 14/03/2024, by
INCIBE (INCIBE)
Decorative photo ransomware
LockBit ransomware has rapidly evolved to become one of the most prolific threats of our time. Its technical sophistication, evidenced by the development of tools, such as StealBit, for automated data exfiltration and its adaptation to attack Linux servers, specifically ESXi, demonstrate the advanced adaptability and potential impact on affected organizations.In addition, the implementation of a ransomware-as-a-service (RaaS) model and double extortion tactics underscore the complexity and coercive nature of their campaigns. The response to this threat, however, has culminated in a collaborative law enforcement effort that has succeeded in dismantling LockBit's infrastructure, leading to the arrest and indictment of several of its operators. In this article we focus on the version of LockBit 3.0, presenting its main features and the current tools for recovering data in case it has been compromised.

ROA: the key to route verification on the network

Posted on 07/03/2024, by
INCIBE (INCIBE)
Decorative photo of a keyboard.
Within the framework of RPKI security infrastructures, ROAs are crucial components in the defense of cyberspace, providing authentication and verification mechanisms for routes vital to the security of Internet routing. Despite its undeniable benefits, creating and maintaining ROA has its own set of challenges and considerations. This article explores the relevance of ROAs, examines their inherent challenges, and underscores the importance of secure implementation and management to strengthen Internet resilience.

SASE architecture in your cybersecurity strategy

Posted on 22/02/2024, by
INCIBE (INCIBE)
Decorative photo of a digital cloud
The changing dynamics of the work environment and the increasing reliance on cloud-based solutions have catapulted Secure Access Service Edge (SASE) systems into the spotlight in the cybersecurity world, offering the possibility of integrating network security and access management into a cloud-based solution, offering flexibility and protection.This article delves into the architecture and philosophy behind SASE, explaining how it redefines security and access in cloud systems.

ICS malware analysis study: BlackEnergy

Posted on 15/02/2024, by
INCIBE (INCIBE)
Threat analysis study decorative image
The industrial environment, especially the energy sector, is one of sectors that is suffering the most from cyber-attacks. This trend has been increasing in recent years, as this is one of the most information-sensitive sectors and can cause major problems, both economically and socially.One of the best examples of malware attacks is BlackEnergy. This malware became known for being able to compromise several electricity distributors on 23 December 2015, causing households in the Ivano-Frankvisk region of Ukraine (a population of around 1.5 million) to be without electricity.For this reason, due to seriousness of this type of cyberattacks, it is necessary to continue researching and investing in industrial cybersecurity, to reduce the damage caused by this type of cyber-attack in industrial environments.

NB-IoT the ideal and low-power conection for IIoT

Posted on 08/02/2024, by
INCIBE (INCIBE)
Decorative photo about Industrial Internet of Things
IoT networks are very useful for everyday life, but their use is not limited only to this type of environment; there are industrial environments where this type of networks can benefit connectivity between industrial devices and provide capabilities that other types of networks could not. The 3rd Generation Partnership Project or 3GPP developed the NB-IoT protocol, a protocol for when networks with higher performance, higher speed and high interconnectivity capacity between devices are required. This protocol can work both in IoT devices and in IoT devices in the industrial environment (IIoT).

RPKI: securing Internet routes against attackers

Posted on 01/02/2024, by
INCIBE (INCIBE)
Decorative photo RPKI: securing Internet routes against attackers
The Resource Public Key Infrastructure (RPKI) is essential for Internet routing security, as it provides a method to securely connect IP addresses to autonomous systems (AS) by validating route information. RPKI effectively prevents BGP Hijacking-type attacks, where potential attackers maliciously redirect Internet traffic. This article aims to explore the design, implementation, and benefits of using RPKI to ensure security and authenticity in Internet routing.

Cibersecurity in the healthcare sector: features, threats and recommendations

Posted on 25/01/2024, by
Juan Díez González
Cibersecurity in the healthcare sector
After the pandemic, it has been observed that the healthcare sector has been one of the most attacked by cybercrimilas and organizations. This has generated a significant impact on the affected organitations, making it essencial to protect this sector due to its strategic nature and to achieve this, it is neccesary to understand its characteristics and the threats that affect it.

Industrial security 2023 in numbers

Posted on 18/01/2024, by
INCIBE (INCIBE)
decorative image Industrial security 2023 in numbers
Article summarizing the Industrial Control Systems (ICS) alerts published during the year 2023 on the INCIBE-CERT website, with emphasis on different indicators, such as criticality, type of attack, etc.The motivation is to give the published notices an added value, in order to compile the information of the whole year as a logbook. In addition, this type of article was well received in previous years, showing in several talks the graphs of the article to argue the exponential growth of vulnerabilities in ICS. 

Go top