Cyber Security Threat Summary:
“The Clop ransomware group added five new victims of MOVEit attacks to its dark web leak site, including the industrial giants Schneider Electric and Siemens Energy. Both Schneider Electric and Siemens Energy provide Industrial Control Systems (ICS) that are used in critical national infrastructure worldwide” (Security Affairs, 2023).

Below is the list of victims added to the group’s leak site:

• werum[.]com
• Schneider Electric (se[.]com)
• Siemens Energy (siemens-energy[.]com)
• UCLA (ucla[.]edu)
• Abbie (abbvie[.]com)

The Clop ransomware group has claimed responsibility for hundreds of attacks exploiting the recently discovered MOVEit Transfer vulnerability CVE-2023-34362. “MOVEit Transfer is a managed file transfer that is used by enterprises to securely transfer files using SFTP, SCP, and HTTP-based uploads. The vulnerability is a SQL injection vulnerability, it can be exploited by an unauthenticated attacker to gain unauthorized access to MOVEit Transfer’s database” (Security Affairs, 2023).

Security Officer Comments:
The Clop ransomware group worked quickly to exploit the MOVEit zero-day before the company could issue a patch. After a short delay, the ransomware group is now in the process of contacting victims and posting details on their public leak site. The list of victims of ransomware attacks exploiting the MOVEit Transfer zero-day includes the U.S. Department of Energy, British Airways, Boots, the BBC, Aer Lingus, Ofcom, Shell, University of Rochester, and Gen Digital. The US government is offering up to a $10 million bounty for information linking Clop Ransomware Gang or any other threat actors targeting U.S. critical infrastructure to a foreign government.

At this time It is unclear what sort of data was stolen from the two industrial control system companies, but users of their products should continue to monitor the situation until more details are available. Information stolen could include sensitive business and customer details, but more concerningly could include sensitive intellectual property that could be used to discover vulnerabilities or create exploits in specific products.

Suggested Correction(s):
Backup your data, system images, and configurations, regularly test them, and keep the backups offline: Ensure that backups are regularly tested and that they are not connected to the business network, as many ransomware variants try to find and encrypt or delete accessible backups. Maintaining current backups offline is critical because if your network data is encrypted with ransomware, your organization can restore systems.

Update and patch systems promptly: This includes maintaining the security of operating systems, applications, and firmware in a timely manner. Consider using a centralized patch management system; use a risk- based assessment strategy to drive your patch management program.

Test your incident response plan: There's nothing that shows the gaps in plans more than testing them. Run through some core questions and use those to build an incident response plan: Are you able to sustain business operations without access to certain systems? For how long? Would you turn off your manufacturing operations if business systems such as billing were offline?

Check Your Security Team's Work: Use a 3rd party pen tester to test the security of your systems and your ability to defend against a sophisticated attack. Many ransomware criminals are aggressive and sophisticated and will find the equivalent of unlocked doors.

Segment your networks: There's been a recent shift in ransomware attacks – from stealing data to disrupting operations. It's critically important that your corporate business functions and manufacturing/production operations are separated and that you carefully filter and limit internet access to operational networks, identify links between these networks and develop workarounds or manual controls to ensure ICS networks can be isolated and continue operating if your corporate network is compromised. Regularly test contingency plans such as manual controls so that safety critical functions can be maintained during a cyber incident.

Train employees: Email remains the most vulnerable attack vector for organizations. Users should be trained how to avoid and spot phishing emails. Multi Factor authentication can help prevent malicious access to sensitive services.

Link(s):
https://securityaffairs.com/147865/data-breach/schneider-electric-siemens-energy-moveit.html