Cyber attackers target US natural gas pipeline companies

Unknown attackers are actively targeting natural gas pipeline sector companies in the US with spear phishing emails, the US Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) warns with its monthly newsletter.

“Analysis of the malware and artifacts associated with these cyber attacks has positively identified this activity as related to a single campaign with spear-phishing activity dating back to as early as December 2011,” claims the team.

“Analysis shows that the spear-phishing attempts have targeted a variety of personnel within these organizations; however, the number of persons targeted appears to be tightly focused. In addition, the e-mails have been convincingly crafted to appear as though they were sent from a trusted member internal to the organization.”

The newsletter does not contain details about the received emails and the attached malware, but this information was included in a confidential alert and two updates that the team sent to sector organizations and agencies.

“The indicators in these alerts are considered sensitive and cannot be disseminated through public or unsecure channels,” it says in the newsletter, but the CSM has managed to discover some details from an unnamed security expert.

According to this source, the confidential alerts contained file names, IP addresses, and other information that would indicate to the companies’ IT security teams that their networks have been breached.

Curiously enough, the alerts also asked the companies who found evidence of a breach not to try and boot out the attackers from their networks – unless their operations are endangered – and to collect data related to the intrusions.

On the other hand, the newsletter seems to contradict that claim.

“ICS-CERT is currently engaged with multiple organizations to provide remote and onsite analytic assistance to confirm the compromise, extent of infection, and assist in removing it from networks,” it says.

“ICS-CERT does NOT recommend enabling the intrusion activity to persist within networks and has been working aggressively with affected organizations to prepare mitigation plans customized to their current network security configurations to remove the threat and harden networks from re-infection.”

The newsletter does not mention how many companies were targeted and/or breached.