Abuses Windows’ autorun functionality to spread copies of itself over USBs, network shares, and external storage drives.Identifies security products (AVs, firewalls) and terminates them.Uses process injection and file infection to achieve persistence.The password-cracking software also carries a dropper that infects the machine with Sality malware, which: A threat actor is targeting industrial engineers and operators with trojanized password-cracking software for programmable logic controllers (PLCs) and human-machine interfaces (HMIs), exploiting their pressing needs to turn industrial workstations into dangerous bots.Īccording to Dragos researchers, the adversary seems not to be interested in disrupting industrial processes but making money.
0 kommentar(er)
