Power stations under attack from long-running hacking campaign

Dragonfly threat group is ramping up activities, say researchers

Energy companies in the US and Europe are being targeted by an increasingly intense campaign of cyber attacks, security researchers have warned.

According to security firm Symantec, power companies in the US, Turkey and Switzerland have been targeted by a group of highly sophisticated hackers, which has been operating since at least 2011.

The group, which researchers have dubbed 'Dragonfly', has been attempting to gather intelligence and gain operational control of systems in energy facilities for an unknown purpose.

"The original Dragonfly campaigns now appear to have been a more exploratory phase where the attackers were simply trying to gain access to the networks of targeted organizations," Symantec said.

"The Dragonfly 2.0 campaigns show how the attackers may be entering into a new phase, with recent campaigns potentially providing them with access to operational systems, access that could be used for more disruptive purposes in future."

Dragonfly's targeting of power companies raises echoes of attacks against the Ukrainian energy grid which plunged parts of the country into darkness in 2015 and 2016. However, researchers have not identified any concrete links between those incidents and attacks carried out by Dragonfly, and warned against jumping to conclusions regarding attribution.

The group mostly used popular 'off-the-shelf' malware and widely-available administration tools to carry out attacks, which Symantec theorised could be part of a strategy to thwart attribution attempts.

Researchers also noted what while parts of the malware used by the group were written in Russian, other parts were written in French another potential false flag to throw investigators off the scent.

"Conflicting evidence and what appear to be attempts at misattribution make it difficult to definitively state where this attack group is based or who is behind it," Symantec said.

"What is clear is that Dragonfly is a highly experienced threat actor, capable of compromising numerous organizations, stealing information, and gaining access to key systems. What it plans to do with all this intelligence has yet to become clear, but its capabilities do extend to materially disrupting targeted organizations should it choose to do so."

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Recommended

8 of the most secure web browsers
web browser

8 of the most secure web browsers

25 Sep 2020
Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
The Xbox Series X shows how far the cloud still has to go
Cloud

The Xbox Series X shows how far the cloud still has to go

25 Sep 2020