Malicious objects of all types were detected and blocked on 34% of Industrial Control System (ICS) computers in the first half of 2023, according to the ICS CERT landscape report by Kaspersky.

In Africa over this period attacks were detected on 40,3% of ICS computers, placing it in first place among the other regions. The top industries under attack were energy (45,9%), engineering & integration (44%) and building automation (40%). All these attacks were blocked after detection.

ICS computers are used in oil & gas, energy, automotive manufacturing, building automation infrastructures and other spheres to perform a range of operational technology (OT) functions – from the workstations of engineers and operators to supervisory control and data acquisition (SCADA) servers and Human Machine Interface (HMI).

Cyberattacks on industrial computers are considered to be extremely dangerous as they may cause material losses and production downtime for the controlled production line and even the facility as a whole. Moreover, industrial enterprises put out of service can seriously undermine a region’s social welfare, ecology and macroeconomics.

An analysis of the most significant and targeted threats detected on ICS computers in selected countries of Africa in the first half of 2023 shows that the threat landscape can vary between countries and between industries due to the differences in the security maturity of different countries/industries and the current focus of threat actors.

In South Africa in the first half of 2023 malware was detected and blocked on 29,1% of ICS computers, in Nigeria on 32,6%, in Kenya on 34,5% of machines.

There are different types of cyberthreats that OT-related computers face – malicious scripts, spy trojans, worms, ransomware, and others. In the first half of 2023 Africa had the highest percentage of ICS computers on which spyware was blocked (9,8%).

The Middle East and Southeast Asia had similarly high percentages (8,3% and 8,1%). The global average stands at 6,1%.

Africa was also the region with the highest percentage of ICS computers (14,8%) on which attacks from denylisted Internet resources were blocked (these are web resources associated with distributing or controlling malware). The global average is 11,3%.

Viruses and worms spread across ICS networks by means of removable media, shared folders, infected files, such as backups, and network attacks on outdated software.

The percentage of ICS computers on which worms were detected was very high in Africa (7% vs. 2,3% global average), making this region the leader by percentage of ICS computers on which threats were detected after removable devices were connected.

“Africa’s industrial landscape is diverse, ranging from large-scale mining operations to small-scale agriculture. This means that ICS cybersecurity solutions need to be adaptable to various sectors and technologies.

In some regions, legacy ICS systems that lack modern security features are still in use. These systems are often more vulnerable to cyberthreats and require significant upgrades. Lastly, some critical infrastructure in Africa is located in remote areas with limited connectivity, which can make it difficult to monitor and secure ICS assets effectively,” comments Evgeny Goncharov, Head of Kaspersky ICS CERT.

“By understanding these risks, organisations can make informed decisions, allocate resources wisely, and efficiently fortify their defenses. In doing so, they not only protect their bottom line but also contribute to a safer and more secure digital ecosystem for all.”

Participants in PricewaterhouseCoopers (PwC) Nigeria Tech Talent Bootcamp are at risk of identity theft after private data was leaked from a misconfigured Amazon Web Services account, according to the latest Cybernews research team investigation.

On July 21st, the Cybernews research team conducted a routine check using open-source intelligence (OSINT) methods and revealed a misconfigured Amazon AWS bucket.

According to the Cybernews team, the bucket containing nearly 25,000 sensitive PwC Nigeria files has been attributed to a third-party vendor, Xerde Tech.

The 24,668 exposed files include: copies of passports/government-issued IDs; resumes with phone numbers, home and email addresses, and other private information; and copies of degree/university certificates

PwC was also among the victims of the MOVEit attack earlier this year. The Cl0p ransom gang released data belonging to the company in 11 batches on the dark web and four on the publicly accessible clear web.

“This leak is a significant risk to exposed individuals, as the private information could be used for identity theft, financial fraud, spear-phishing, and scam campaigns. In an environment where the data is easily sold on the dark web, and bad actors specialize in extortion techniques, users should exercise extra caution,” Cybernews researchers said.

Cybernews reached out to PwC Nigeria, and the company resolved the issue, though it had not commented at the time of writing.

Additional Credit: itnewsafrica.com

Sophos, a global leader in innovating and delivering cybersecurity as a service, on Thursday announced its strong results in the MITRE Engenuity ATT&CK® Evaluations. Sophos Intercept X with XDR detected 99% of the adversary behaviors in the evaluation, reporting 141 out of 143 adversary attack steps.

Sophos Intercept X with XDR excelled in the independent ATT&CK Evaluations with its comprehensive EDR and XDR capabilities that deliver actionable context on the “what,” “why” and “how” of attacker behaviors.

In addition, Sophos Intercept X with XDR recorded rich analytic data on 98% of the substeps in the ATT&CK Evaluations.

“As active adversaries continue to prey upon the unprepared, good cybersecurity outcomes increasingly depend upon competent technologies in the hands of skilled operators. MITRE’s evaluation is a powerful objective measurement of a technology’s ability to produce the fundamental observations and classifications needed to effectively identify and defend against attackers,” said Joe Levy, president and chief technology officer at Sophos.

“Sophos meticulously architects its solutions for security operators, empowering them with superior protection, detection and response capabilities for known and unknown threats before they become full-blown, destructive attacks, and we believe MITRE’s evaluation results demonstrate the robustness of Sophos’ real-world security capabilities.”

This round of independent ATT&CK Evaluations evaluated the abilities of 30 vendors in detecting and analyzing attack tactics, techniques and procedures (TTPs) of Turla, a known Russia-based threat group. Turla leverages novel TTPs and custom tooling to evade security defenses, and was chosen as the evaluation adversary based on its innovative stealthy maneuvers; targeted sectors, including government, critical infrastructure, education, and more; and breadth of open-source reporting on its tradecraft.

“Turla is one of the most sophisticated threat actors, and their tradecraft is platform diverse, dynamic in stealth, and layered in persistence,” said Amy Robertson, MITRE cyber threat intelligence lead, ATT&CK Evals. “This round provides an emulation that focused on kernel and service-level operations that often run with the same permissions as detection and protection products.

“Our goal is to empower end users and purchasers with unbiased insights into the product capabilities that detect these advanced adversary behaviors, while also collaborating with the participating vendors to evolve their products.”

Sophos Intercept X with XDR combines active adversary mitigations – including industry-first Adaptive Attack Protection that immediately activates heightened defenses when a hands-on-keyboard attack is detected, stopping the attack and providing defenders valuable additional time to respond; anti-ransomware technology; deep learning artificial intelligence; and exploit prevention to prevent and stop attacks.

It is powered by Sophos X-Ops threat intelligence, a cross-operational task force of more than 500 security experts within SophosLabs, Sophos SecOps and SophosAI.

For more information on Sophos’ evaluation results, watch this video and visit https://attackevals.mitre-engenuity.org/enterprise/turla/.