On June 17, 2010, researchers at VirusBlokAda, an anti-virus software company in Belarus, published a report (.pdf) on a trojan which was specifically designed to target process conrol server software (commonly referred to as SCADA software) used in critical infrastructure. Further work by Frank Boldewin uncovered a snippet of code (figure 2) which specifically calls the Siemens WinCC SCADA system (figure 1).
Figure 1: Siemens software targeted in this attack
Figure 2: WinCC Code Snippet
- Global coverage broken out by country
- Seimens business dealings with RF and PRC
- GreyLogic’s threat analysis identifies 3 key characteristics of this APT attack
Subscription information is available by request.
According to an article in the 14 May 2010 issue of Moscow newspaper “Trud”, the Federal Security Service (FSB) and Ministry of Internal Affairs (MVD) are ramping up efforts to mine the Russian Internet for terrorists planning attacks similar to the Moscow subway bombing:
GreyLogic has been tracking the investments and connections of Digital Sky Technologies (DST) for almost 12 months.
