Xenotime, a group of hackers that has previously targeted oil and gas companies, has been targeting the U.S. electric grid in recent months, according to new research released Friday by cybersecurity group Dragos.

Dragos reported that the Xenotime group began “probing” the networks of electric utilities in both the U.S. and countries in the Asia-Pacific region in late 2018.

The report noted that none of the probes resulted in the group gaining access to an electric utility’s system, but wrote that “the persistent attempts, and expansion in scope is cause for definite concern.”

Dragos added that while none of the probing has been successful, this type of activity could be evidence of the group preparing for future cyberattacks.

The company recommended that owners and operators of industrial control system companies, including U.S. electric, gas and oil utilities, should prepare for attempts to be hacked by the Xenotime group, and bolster their cybersecurity capabilities in response.

This particular group are the same hackers behind malware known as Trisis that was deployed against a Saudi Arabian oil and gas facility in 2017. Dragos wrote that this attack “targeted safety systems,” and was ultimately intended to “cause loss of life or physical damage.”

Dragos wrote that Xenotime is the only known hacking group to target safety systems of utilities with the intention of destroying or disrupting the company. While the Middle East was the group’s original target, it now operates globally.

https://thehill.com/policy/cybersecurity/448587-hacking-group-targeting-us-electric-utilities-report

Mysterious Iranian group is hacking into DNA sequencers

Web-based DNA sequencer applications are under attack from a mysterious hacker group using a still-unpatched zero-day to take control of targeted devices.

The attacks have started two days ago, on June 12, and are still going on, according to Ankit Anubhav, a security researcher with NewSky Security, who shared his findings with ZDNet.

HACKERS PLANTING SHELLS ON DNA SEQUENCER WEB APPS

Anubhav says the group, which operates from an Iran-based IP address, has been scanning the internet for dnaLIMS, a web-based application installed by companies and research institutes to handle DNA sequencing operations.

The researcher told ZDNet the hacker is exploiting CVE-2017-6526, a vulnerability in dnaLIMS that has not been patched to this day after the vendor was notified back in 2017.

Anubhav says the attackers are using this vulnerability to plant shells that allow them to control the underlying web server from remote locations.

ATTACK MOTIVES UNKNOWN

It is unclear how the group is using these backdoors into hacked systems, post infection. Anubhav says there could be two scenarios.

In the first, the attacker may be looking to exfiltrate hashes of DNA sequences from the application's database.

"DNA theft in specific cases can be fruitful," Anubhav said. "Either it can be sold on the black market, or a high profile attacker can actually be looking for a specific person's data."

Second, and the most plausible scenario, is that the attackers might be using the infected servers as part of a botnet, or using the shell to plant cryptocurrency miners on the hijacked systems.

A previous ZDNet report highlighted that most IoT botnets nowadays are the works of attention-seeking kids that take random exploits from the ExploitDB exploit database and assemble botnets at random.

This might be one of those cases, with this botnet's author using an exploit at random, not knowing what they're actually targeting.

"This particular attack may not be useful for a script kiddie or a botnet operator," Anubhav said, pointing out that there are only between 35 and 50 such highly-complex DNA sequencer apps available online, a number far too small to build a botnet around.

GROUP ALSO TARGETED ROUTERS AND STRUTS SERVERS

Furthermore, the theory that this might be the work of a script kiddie playing with random exploits, rather than a nation-state sponsored group, becomes more believable when we look at the historical activity coming from the attacker's IP address.

Per NewSky's own records, the attacker has been seen using the nmap tool to scan the internet and attempt to use two other exploits to take over systems – one for Zyxel routers, and a second for Apache Struts installations.

"We can not decide on the motive of these attacks just yet," Anubhav told ZDNet. "Regardless, the DNA sequencer systems which hold this confidential information can get pwned."

With the vendor refusing to patch the security flaw back in 2017, these systems remain open for attacks.

The dangers that these systems pose can only be evaluated on a per-case basis. If the DNA sequencing data is anonymized, any stolen data will most likely be useless. If not, then a serious breach may occur if the hackers have stolen any info from these systems.

Sure, DNA data may be useless right now, but with biometric solutions spreading every year, non-anonymized data might be actually worth something in a few years from now.

https://www.zdnet.com/article/mysterious-iranian-group-is-hacking-into-dna-sequencers/

Telegram traces cyber-attack during HK protests to China

Encrypted messaging service Telegram suffered a major cyber-attack that originated from China, the company's CEO said Thursday, linking it to the ongoing political unrest in Hong Kong.

Many protesters in the city have used Telegram to evade electronic surveillance and coordinate their demonstrations against a controversial Beijing-backed plan that would allow extraditions from the semi-autonomous territory to the mainland.

Demonstrations descended into violence Wednesday as police used tear gas and rubber bullets to disperse protesters who tried to storm the city's parliament – the worst political crisis Hong Kong has seen since its 1997 handover from Britain to China.

Telegram announced Wednesday that it was suffering a "powerful" Distributed Denial of Service (DDoS) attack, which involves a hacker overwhelming a target's servers by making a massive number of junk requests.

It warned that users in many regions may face connection issues.

Pavel Durov, Telegram's CEO, said the junk requests came mostly from China.

"Historically, all state actor-sized DDoS (200-400 Gb/s of junk) we experienced coincided in time with protests in Hong Kong (coordinated on @telegram)," he tweeted.

"This case was not an exception."

Telegram later announced on Twitter that its service had stabilised. It also posted a series of tweets explaining the nature of the attack.

"Imagine that an army of lemmings just jumped the queue at McDonald's in front of you -– and each is ordering a whopper," it said, referring to the flagship product of Burger King.

"The server is busy telling the whopper lemmings they came to the wrong place -– but there are so many of them that the server can't even see you to try and take your order."

• Evading surveillance -

When asked about Durov's claim the attack originated from China, foreign ministry spokesman Geng Shuang said he was not aware of the incident.

"What I can tell you here is that China has always opposed any form of cyber-attacks. China is also a victim of cyber-attacks," Geng said at a regular press briefing in Beijing.

China's cyberspace administration did not immediately respond to AFP's request for comment.

Telegram was launched in 2013, and allows users to exchange encrypted text messages, photos and videos, and also create "channels" for as many as 200,000 people. It also supports encrypted voice calls.

The firm announced last year that it had crossed 200 million monthly active users.

Encrypted messaging apps like Telegram and WhatsApp are preferred around the world by a wide variety of people trying to avoid surveillance by authorities – from Islamic State jihadists and drug dealers to human rights activists and journalists.

Governments in recent years have devoted significant resources to try and breach or bypass the security features of these apps, according to tech firms and researchers. Some states have outright banned them.

Hong Kong is not behind China's Great Firewall, which heavily restricts internet access in the mainland – where Telegram is blocked.

The city's special status under its handover agreement allows freedoms unseen in mainland China, but many fear they are under threat as Beijing exerts increasing influence on Hong Kong.

The current protests were sparked by fears the proposed law would allow extraditions to China and leave people exposed to the mainland's politicised and opaque justice system.

https://news.yahoo.com/telegram-hit-cyber-attack-ceo-points-hk-protests-033515703.html