Scanning for OMRON using the FINS (Factory Interface Network Service) protocol.The threat actor tool that targets those devices has modules that allow attackers to: Send custom Modbus commands (which can also work against Modbus devices in addition to Schneider Electric PLCs)Īffected devices are OMRON Sysmac NJ and NX PLCs, including (but may not be limited to) NEX NX1P2, NX-S元300, NX-ECC203, NJ501-1300, S8VK, and R88D-1SN10F-ECT.Crash the PLC until a power cycle and configuration restore is performed.Suspend connections, requiring users to re-authenticate to PLC, likely facilitating the capture of valid credentials.Perform denial-of-service attack to prevent reaching PLCs.Brute-force PLC passwords using CODESYS and other available device protocols against default values or dictionary dictionary.Quickly scan a local area network for all Schneider PLCs.The threat actor tool targeting these devices has modules that communicate via normal management protocols and Modbus protocols, allowing attackers to:
Several Schneider Electric MODICON and MODICON Nano PLCs (programmable logic controllers), including (but may not be limited to) TM251, TM241, M258, M238, LMC058, and LMC078, are affected.
Several of the attacker tools are listed in the advisory based on the targeted hardware. Must-Read Security Coverage Targeted devices and servers energy sector that certain advanced persistent threat (APT) threats have demonstrated ability to gain full system access to multiple industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices. The Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) are warning the U.S. A new joint advisory from several US government agencies has just been released.
0 kommentar(er)
