,
10 tweets,
2 min read
Read on Twitter
Quick break down on what the Dragos blog today on XENOTIME does and doesn’t mean. Thread:
XENOTIME is the threat responsible for the TRISIS (TRITON) attack in Saudi Arabia. For months Dragos has tracked them including penetrating oil and gas companies in North America. We also observed them start to target (specific reconnaissance) against US electric utilities.
We’ve been privately reporting to the community and made sure we worked with appropriate orgs who could get the word out to the utilities. XENOTIME is the only threat to have crossed the line to have ever tried to kill someone (TRISIS targeted safety systems). It’s serious.
We were made aware some of that reporting through organizations was accidentally made public by an organization so we published the blog to make sure to capture the story correctly. Key points to follow.
XENOTIME is the threat, this does NOT mean TRISIS or any variant of malware has been deployed somewhere else. What we track here and are talking about is the adversary themselves and their intrusions.
XENOTIME is a very serious threat so an additional set of targeting towards specific electric utilities and the type of recon they’re doing is very concerning and (publicly) new info. There have NOT been compromised electric utilities that we know of.
Every asset owner and operator that we had communicated with or had our private sector or government partners communicate with them that they were being targeted took things very seriously and prepared appropriately. We have work to do as an ICS community but so many do so much.
There is no reason to freak out or hype this up there’s only the reason to note that this is indeed very serious and as an example of threat and tradecraft proliferation in ICS as a community we can’t go “that’s not my sector” and ignore the ICS specific threats. Learn from them
XENOTIME is one of four threats to ever develop malware to successfully cause disruption or destruction of an ICS. They’re a sophisticated and aggressive team. But we haven’t yet seen additional malware by them. As with all things with proper preparation defense is doable.
As an alternative: his Tl;DR was better than mine -
