The Industrial Control System Threat Landscape report for H2 2020 has been published recently by cybersecurity firm Kaspersky.

The report deals with statistical data gathered by the distributed antivirus Kaspersky Security Network (KSN). Cybersecurity experts analyzed the data which were obtained from ICS computers, executing Kaspersky security products that are hosted in various networks of industrial infrastructures. The Windows systems entailed in the analysts can do the following sets of work: Supervisory control and data acquisition (SCADA) servers Data storage servers (Historian) Data gateways (OPC) Stationary workstations of engineers and operators Mobile workstations of engineers and operators Human Machine Interface (HMI) Computers used for industrial network administration Computers used to develop software for industrial automation systems

There has been a percentage rise in the number of cyberattacks on ICS computers in the latter part of the year, worldwide, which was 33.4% ( 0.85% than H1 2020). The percentage of ICS computers facing issues from the hackers augmented, compared to H1, in 62% of countries. This percentage stood at 7% in 2019 and H1 2020 compared to H2 2019. The nation that saw the highest rise in the number of attacks was Saudi Arabia (+8.2%).

However, there is a dip in the number of ransomware attacks on industrial control system (ICS) computers, mentioned in the report in its very first data. But then again, there has been an increase in these sorts of attacks in developed nations.

“We believe that these curious dynamics could indicate the response of threat actors to the economic consequences of the pandemic. In those countries where the ‘creditworthiness’ of organizations decreased as a result of the pandemic, the number of attacks on industrial enterprises also fell (and so did the percentage of attacked ICS computers).” reads the report.

“At the same time, in countries where industrial organizations were generally more financially stable and were still able to pay a ransom, the activity of attackers increased (and the percentage of attacked ICS computers surged). It can be hypothesized that the changes that we observed were due, among others, to a shift in some groups’ focus when choosing victims towards organizations in more economically stable countries..”

In 2020, Kaspersky solutions blocked ransomware infection attempts on 0.77% of ICS devices; the percentage of ICS computers targeted by cyber-attacks was more significant in Asia than the rest of the world.

In 2020 overall, the percentage of ICS computers on which Kaspersky solutions blocked malicious objects was 38.6% (-7.8% than in 2019). Unlike past years, in 2020, experts did not observe seasonal fluctuations in cyber attacks.

Which are the most secure countries in H2 2020?

Israel ranked first in H2 2020 with a record low of 4.3%, followed by Denmark at 7.2 and Ireland at 8.6.

The internet, removable media, and email continue to be the primary attack vectors for systems computers in organizations' industrial infrastructure.

Let’s close with analyzing the variety of malware detected in H2 2020; Kaspersky blocked over 19,400 malware variants from 5,365 different families on industrial automation systems.

Source