• 4 days Retail On Pace For Most Bankruptcies And Store Closures Ever In One Year: BDO
  • 10 minutes America Could Go Fully Electric Right Now
  • 5 hours Majors Oil COs diversify into Renewables ? What synergies forget have with Solar Panels and Wind Tirbines ? None !
  • 8 hours Something wicked this way comes
  • 15 hours A sneak peak into the US election
  • 4 hours France Sees 10.6% EV Market Share In September — 4× Growth Year On Year
  • 33 mins America's Frontline Doctors - Safely Start Living Again!
  • 4 hours Permian in for Prosperous and Bright Future
  • 1 day covid. stop the carriers and thus stop the virus.
  • 2 days "COVID Kills Another Oil Rally" by Tom Kool 10/16/2020
  • 2 days Is the coal industry on the way out?
  • 7 hours Tesla Model 3 Is September's Top Selling Car of All Vehicles in Switzerland
  • 2 days GPOR - Gulfport Oil - Why?
  • 21 hours California’s Electric Vehicle Dream Has A Major Problem: No
  • 2 days Tucker Carlson responds to CDC after agency critiques commentary about mask-wearing
  • 1 day Vote Biden for Higher Oil Prices
  • 1 day Ethanol present in gasoline
The Geopolitical Influence Of Natural Gas

The Geopolitical Influence Of Natural Gas

Natural gas is becoming increasingly…

The $4.2 Trillion Trend Taking Over Wall Street

The $4.2 Trillion Trend Taking Over Wall Street

The ESG megatrend has taken…

Tsvetana Paraskova

Tsvetana Paraskova

Tsvetana is a writer for Oilprice.com with over a decade of experience writing for news outlets such as iNVEZZ and SeeNews. 

More Info

Premium Content

Are Iranian Hackers Planning An Attack On Key Oil Assets?

An infamous Iranian hacker group may be targeting industrial control systems to cause major disruptions in power grids, oil refineries, and other physical energy assets, in an apparent sharpened focus on cyber warfare on critical industries.

These attempts by Iranian hackers to infiltrate systems controlling energy assets come at a time of heightened tension between the United States and Iran and at a time of increased cyber threats to the energy industry in the United States and globally.

Iranian hacker group APT33—also known as Elfin, Refined Kitten, and Holmium—is thought to have recently shifted its focus from IT networks onto industrial control systems (ICS) that control utilities and oil refineries, among other industries, Microsoft security researcher Ned Moran tells WIRED’s senior writer Andy Greenberg.

Moran presented Microsoft’s findings at the CyberwarCon conference in Arlington, Virginia, this week. Those findings show that the Iranian hackers have narrowed over the past two months their password spraying—attempts to access a large number of accounts with a few common passwords—onto around 2,000 organizations, but have increased the number of targeted accounts. According to Microsoft’s Moran, half of the 25 top organizations that the hackers try to hack are industrial control system (ICS) manufacturers and providers.  

It’s unclear if the hackers have cracked any of the systems they attempted to hack. Their motivation is also unclear, but Microsoft’s Moran thinks that the ultimate goal is to try to gain access to a system in order to carry out a physically devastating attack on critical infrastructure, such as energy infrastructure.

By targeting ICS, the Iranian hackers are “trying to find the downstream customer, to find out how they work and who uses them. They’re looking to inflict some pain on someone’s critical infrastructure that makes use of these control systems,” Moran told WIRED. Related: This Large Oil Producer Is Facing A Major Refining Crisis

Cybersecurity solutions firms Trend Micro said earlier this month that it believes the APT33 group has been using about a dozen live Command and Control (C&C) servers for extremely narrow targeting against organizations in the Middle East, the United States, and Asia.

The apparent shift in the Iranian hacker group’s focus highlights the threats to critical U.S. infrastructure, including energy infrastructure, which has seen the frequency of cyberattacks increase over the past couple of years.   

Last year, the same Iranian hacker group stepped up its attacks on a variety of companies in the Persian Gulf, including energy firms.  

According to The National, there is wide belief that the hacker group is linked to the government in Tehran, with the attacks becoming more frequent after U.S. President Donald Trump pulled the Untied States out of the Iran nuclear deal.

APT33 is also believed to be responsible for the Shamoon malware attack that hit the servers of Saudi oil giant Aramco in 2012 and which returned last year with a new version.

McAfee has concluded that APT33 could be the malign actor behind the Shamoon attacks. Related: Putin Calls U.S. Shale “Barbaric”

“After further analysis of the three versions of Shamoon and based on the evidence we describe here, we conclude that the Iranian hacker group APT33—or a group masquerading as APT33—is likely responsible for these attacks,” the McAfee Advanced Threat Research team said.

APT33, or Elfin, has been highly active in the past three years, Symantec said in March 2019, noting that the hacker group—although primarily focused on targets in Saudi Arabia—has a high interest in targets in the United States.

Meanwhile, the U.S. is looking to strengthen cyber security at critical energy infrastructure. The U.S. Department of Energy is awarding millions of US dollars in research and development of next-generation tools and technologies aimed at improving the cybersecurity of the critical American energy infrastructure, including the electric grid and oil and natural gas infrastructure.

In September, the North American Electric Reliability Corporation’s (NERC) Electricity Information Sharing and Analysis Center (E-ISAC) and the Oil and Natural Gas Information Sharing and Analysis Center (ONG-ISAC) formed a partnership to improve information sharing between the organizations and their members to enhance the cyber security of North America.

Any effort to beef up cyber security is not overstated in the face of increasingly inventive cyber threats.

By Tsvetana Paraskova for Oilprice.com

More Top Reads From Oilprice.com:

Download The Free Oilprice App Today

Back to homepage

Leave a comment

Leave a comment

Oilprice - The No. 1 Source for Oil & Energy News