Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
Hackers are targeting the second of two four-year-old vulnerabilities in the open source supervisory control and data acquisition platform.
The US Cybersecurity & Infrastructure Agency has added a second ScadaBR vulnerability to its catalogue of known exploited vulnerabilities.
CVE-2021-26828 is present in OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows, and could allow remote, authenticated users to upload arbitrary code and ultimately perform remote code execution via .jsp files.
The vulnerability has a CVSS score of 8.7, making it a High Severity issue.
CVE-2021-26828 was initially disclosed in June 2021, at the same time as CVE-2021-26829, which CISA added to its KEV Catalog earlier this week.
Cyber security firm Forescout outlined in an October 9 blog post how the Russian hacktivist group TwoNet were observed targeting the latter vulnerability in one of their honeypots. At the same time, they also noted similar exploitation of CVE-2021-26828.
The firm spotted two Russian-linked IP addresses targeting the vulnerability, which was present in one of their honeypots posing as a water treatment facility – an apparently juicy critical infrastructure target. Both IPs are registered to a Moldovan hosting provider with links to bulletproof hosting provider, Stark Industries Solutions.
According to cyber security guru Brian Krebs, Stark Industries Solutions is a “frequent source of massive DDoS attacks, Russian-language proxy and VPN services, malware tied to Russia-backed hacking groups, and fake news.”
“We assess with moderate confidence that the actions from these two IPs were coordinated, evidenced by tight sequencing and complementary roles (initial access and web shell placement followed by extended [Human Machine Interface]-level tampering),” Forescout said.
“The exploitation path (default credentials → CVE-2021-26828 → web shell) and subsequent HMI-only activity are consistent with low-to-moderate capability operators leveraging publicly available tooling.”
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
