Practical Industrial Internet of Things Security

Exploit loopholes to perform the attack

The Ukrainian power grids had implemented certain security measures, mostly perimeter defenses, for example, corporate and OT network segmentation. The adversary, through extensive reconnaissance, developed and delivered exploits to break through those defenses. They launched spear phishing attacks to inject BlackEnergy 3 malware, and harnessed credentials to gain remote access into the workstations and HMIs by exploiting trusted VPN connections.