ICS Threats: Malware Targeting OT? It’s More Common Than You Think

Malware targeting operational technology (OT) and industrial control systems (ICS) is evolving. While OT-specific malware remains rare, our latest research indicates that generic malware, such as botnets, is increasingly targeting OT devices.

We’ve analyzed recent submissions on VirusTotal  and uncovered various botnet clusters (e.g., Aisuru, Kaiten, Gafgyt) that exploit OT default credentials and  wipe data directories. These discoveries highlight the growing risk to OT environments beyond specialized malware from opportunistic attacks by generic threats.

To protect against these risks, organizations must identify and secure exposed OT and ICS devices, update default credentials, and monitor networks for malicious activity.

Motivation: A Brief History of ICS Threats: Malware Targeting OT

Hundreds of thousands of new malware samples are created by threat actors daily — and are often submitted to public repositories like VirusTotal. Most of these target IT systems running Windows on x86 or x64 architectures. Remote access trojans (RATs) and infostealers are the most common malware categories, as reported in our 2023 threat roundup.

However, since the infamous Mirai botnet emerged in 2016, malware targeting Internet of Things (IoT) devices has surged in the form of DDoS botnets infecting embedded systems. DDoS botnets were the third most popular malware category in our threat roundup. Additionally, we recently published research about botnets that go beyond DDoS to wipe IoT devices.

Historically, OT-specific malware was extremely rare. Between 2010 and 2017 only five OT-targeting malware were identified (Stuxnet, Havex, BlackEnergy3 Industroyer and Triton). However, since 2022 there have been five more significant OT malware discoveries, including Industroyer2 and INCONTROLLER in 2022, COSMICENERGY in 2023, Fuxnet and FrostyGoop/BUSTLEBERM in 2024.

Additionally, several other malware, such as VPNFilter with its Modbus protocol module, and Acid Rain, indirectly impacted OT systems —while some ransomware (like EKANS) target OT-related Windows processes.

Several of these malware, including COSMICENERGY, FrostyGoop/BUSTLEBERM and AcidRain, were first found on public repositories. Our recent research took a closer look at VirusTotal around the time of  the latest major discovery, FrostyGoop/BUSTLEBERM, to hunt for other OT-related threats. What we found reveals the broader landscape of potential risks to OT systems.

The Hunt: Searching for OT/ICS Malware on VirusTotal

OT-specific malware often interacts with OT devices using engineering protocols like Modbus (FrostyGoop/BUSTLEBERM), IEC-104 (Industroyer), or S7 (Stuxnet). These malware types frequently contain tell-tale strings, such as protocol names or specific credentials, which can serve as ‘signatures’ to identify OT capabilities. In many cases, these malware directly used or at least based their code on open source libraries implementing these protocols.

We developed a YARA rule with 136 OT-related signatures across several protocols, as below.

For Go, the signatures are based on the names of open-source libraries. We identified more than 40 of those. For the other languages, the signatures are based on either debug strings or byte sequences on binaries.

Using VirusTotal’s RetroHunt service, we analyzed files submitted for a three-month period (between June 11 and September 11, 2024). Our hunt matched 989 files: 55% were Windows executables and 45% were ELF executables for Linux/Unix-like systems. These files were compiled for 15 different CPU architectures. The majority (66%) targeted x86 or x64 architectures and 21% targeted ARM flavors.

The figure below summarizes the file distribution per protocol. The most common protocol was Modbus, which is also the most exposed and the most attacked OT protocol. The sum is larger than the 989 unique samples because some files match more than one protocol.

After analyzing these files, we categorized them as either benign (involving legitimate OT protocol interactions, firmware or network inspection tools) or malicious. Among the malicious ones, we identified three FrostyGoop/BUSTLEBERM samples — which aligns to the timing of that malware’s discovery. And, 19 samples were linked to botnet-related activity (usually classified generically as either Mirai or Gafgyt in VirusTotal).

Two files were corrupted, making it impossible to determine if they were malicious. Another file exhibited typical malware behavior by using shared memory to load executables, but without the loaded binary we couldn’t confirm its maliciousness.

Overall, only a very small portion of the files caught in this hunt were malicious and an even smaller subset was OT-specific (only the three FrostyGoop/BUSTLEBERM samples). While OT-specific malware is increasingly frequent, it’s still not a common occurrence. However, the botnet-related files warrant further investigation.

The Catch: Botnets Wipe ‘modbus_rtu’ and Infect Via PLC Credentials

All 19 samples identified as Mirai or Gafgyt were flagged by our rule because they contained the string ‘/mnt/modbus_rtu’. During our investigation, we noticed that several of these samples originated from URLs containing the string “hoho4christmastrees”. This led us to broaden our search to include that URL, ultimately resulting in the discovery of  29 samples, as detailed below.

 

The table above is organized by the date and time the samples were first submitted to VirusTotal. All were initially submitted between May and August 2020 primarily from Japan — with the exception of the last seven samples. All samples were re-submitted on July 18, 2024 from India.

The filenames suggest that these samples are a part of the Aisuru botnet which was first identified around June 2020. Interestingly, a botnet with the same name was used in an attack on the Steam gaming service on  August 24, 2024 — though the two incidents seem unrelated.

The table highlights two key details:

Modbus Directory

Samples containing the ‘/mnt/modbus_rtu’ string match the original samples and indicate this botnet’s wiping capabilities. This string points to one of the directories that the malware attempts to wipe. While earlier versions of Aisuru did not include this functionality, the wiping capability has been present in every sample since June 10, 2020. For more on IoT wiper behavior, see our recent blog.

PLC Credentials

The malware includes known default credentials for two niche lines of programmable logic controllers (PLCs): INTEG JNIOR and Elsist SlimLine. These credentials are used to infect the devices and originate from the original Brickerbot wiper — which did not include the “modbus_rtu” directory. Though these PLCs are relatively uncommon, there are over 700 exposed Elsist devices, mainly located in Italy, as shown below. In addition, the botnet also includes credentials for various IoT devices, such as IP cameras and DVRs.

Expanding the Search: Botnets With Other PLC Credentials

Since we saw botnets using default credentials for niche controllers, we expanded our search to include more widely used default OT/ICS passwords. To do this, we leveraged the Forescout eyeInspect database which contains hundreds of default credentials for OT devices.

This expanded search uncovered 17 samples from another botnet that used the following known default credentials for various OT products:

These credentials were also mixed with general IoT passwords, but unlike the earlier findings, these samples were more recent. They were all downloaded from a dropper shell script (hash: 86d0b365f87a8fda44d605b072ff08fe349f95c70679461ac48e60933a120490) which was hosted on http://176.123.1[.]32/ or http://network[.]irc6[.]xyz. All the samples were submitted to VirusTotal from the US on August 21, 2024. The identified samples are as follows:

 

The filename ‘scanirc.*’ is not linked to any specific botnet family, but these samples include the string “Modified Kaiten” which indicates they are a variant of the Kaiten botnet. This botnet first appeared back in 2016 shortly after the Mirai botnet.

Additionally, 21 other samples of the same “Modified Kaiten” botnet were submitted on July 4, 2024 from the US. These samples were distributed from a different IP address (79.33.237[.]158) and followed a different file naming pattern http://79.33.237[.]158/mq* where ‘*’ represents the target architecture.

We also identified two other clusters using only the “hexakisoctahedron” default password of Schneider Electric Modicon Quantum PLCs:

• One cluster included 32 Gafgyt variant samples, first seen between July 1 and July 24,originating from IP addresses 45.95.146[.]42, 95.214.27[.]246, 91.92.241[.]244 and 154.216.17[.]106.
• Another cluster contained over 150 samples of a distinct Gafgyt variant first seen between July 6 through the end of the analysis period. These samples were downloaded from IP addresses 85.239.34[.]237, 95.214.27[.]246, 185.244.36[.]159, 94.156.71[.]248, 179.43.139[.]194, 193.233.161[.]226, 147.78.103[.]71, 154.216.19[.]71, 185.216.70[.]121, 185.216.70[.]9, 77.90.37[.]71, 94.156.79[.]191.

The targeting of Modicon PLCs is important for several reasons. Modicon PLCs use the Modbus protocol and are widely deployed. This is a line of devices in which we found vulnerabilities in the past. They are often exposed on the Internet including in critical infrastructure, including hydroelectric power stations and solar farms. These PLCs have previously been targeted by the OT-specific malware INCONTROLLER, as well as by hacktivists. Now, botnets, which typically infect exposed IoT devices,  are also setting their sights on them.

Currently, over 3,500 Modicon PLCs are exposed online. Not all use the default “hexakisoctahedron” password. This number has been decreasing by 17% over the past few years (from 4,029 devices in June 2021 to 3,339 in June 2024). The most commonly exposed models are the M340 and the M221, as shown below.

Conclusion and Mitigation Recommendations

The key takeaway from this research is that OT-specific malware, while increasing in frequency,  is far from the most common threat to OT devices. In fact, exposed OT devices are more frequently targeted by opportunistic attackers, including hacktivists and generic malware, such as botnets. These attackers exploit well-known credentials and attempt to wipe data, spread malware or launch DDoS attacks.

Through our Adversary Engagement Environment (AEE), we deploy real and simulated purposely-vulnerable OT assets worldwide, such as PLCs, industrial routers and HMIs, to observe threat actor behavior. The most frequent activity we detect is login attempts using well-known credentials: We’ve observed over 20,000 attempts between September and October 2024 — for an average of more than 600 per day.

To safeguard OT environments, we recommend the following measures:

• Harden OT Devices

Identify all devices connected to your network, assess their open ports and credentials, and ensure that default or easily guessable credentials are changed. Disable any unused services to minimize attack surface.

 

• Network Segmentation

Avoid directly exposing OT devices to the internet. Follow CISA’s guidance on securely providing remote access for industrial control systems. Properly segment networks to isolate IT, IoT and OT devices limiting network connections to only authorized management and engineering workstations or among unmanaged devices that need to communicate.

 

• Monitor for Threats

Implement IoT/OT-aware monitoring solutions that can detect malicious indicators and behaviors. This includes flagging the use of blacklisted credentials and unauthorized OT protocol activity within your network.

Indicators of Compromise (IoCs) including IP addresses and others not listed here for brevity, such as file hashes, are available on the Forescout Research – Vedere Labs threat feed.

 

Share This: Share on LinkedinShare on TwitterShare on Facebook