San Francisco, May 26 Cyber-security researchers have spotted a new Russia-linked malware that is designed to cause electric power disruption via attacking critical infrastructure systems and electric grids.
Mandiant identified the malware, dubbed as CosmicEnergy, that can cause electric power disruption by interacting with devices such as remote terminal units (RTUs) that are commonly leveraged in electric transmission and distribution operations in Europe, the Middle East, and Asia.
"Analysis into the malware and its functionality reveals that its capabilities are comparable to those employed in previous incidents and malware, which were deployed in the past to impact electricity transmission and distribution," the researchers noted in a blog post.
The team believes CosmicEnergy poses a plausible threat to affected electric grid assets.
The new malware was possibly developed by either Rostelecom-Solar or an associated party to recreate real attack scenarios against energy grid assets.
"It is possible that the malware was used to support exercises such as the ones hosted by Rostelecom-Solar in 2021 in collaboration with the Russian Ministry of Energy or in 2022 for the St. Petersburga¿s International Economic Forum (SPIEF)," the report informed.
While its capabilities are not significantly different from previous malware families, its discovery highlights several notable developments in the operational technology (OT)A threat landscape.
"The discovery of new OT malware presents an immediate threat to affected organisations, since these discoveries are rare and because the malware principally takes advantage of insecure by design features of OT environments that are unlikely to be remedied any time soon," said the researchers.
Disclaimer: This post has been auto-published from an agency feed without any modifications to the text and has not been reviewed by an editor