{"id":2532,"date":"2024-09-25T18:43:23","date_gmt":"2024-09-25T18:43:23","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2532"},"modified":"2025-07-29T03:52:13","modified_gmt":"2025-07-29T03:52:13","slug":"ics-attacks-on-nuclear-facilities-a-cause-for-alarm","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/ics-attacks-on-nuclear-facilities-a-cause-for-alarm\/","title":{"rendered":"ICS Attacks on Nuclear Facilities: A Cause for Alarm"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

The geopolitical scenario of United States and Iran has often spilled over into the realm of Cyberspace between the countries and 2020 was no exception. On 6th January 2020 the US department of Homeland Security published a Cyber Alert<\/a>  which is to be considered as an anticipated warning for Iran in response to a Baghdad strike by US forces. 

The Cyber Alert <\/a>published by US CERT focuses on the country\u2019s Critical Infrastructures which are the possible targets  for a cyber-attack by Iranian threat actors. The industrial sector and critical infrastructure consist of a wide range of industries like transport, manufacturing, electricity supply and Energy, mining, water utilities  and supply, nuclear facilities, automobile manufacturing, maritime manufacturing and shipping, etc. Now each of these industries are a possible target of state sponsored cyber terrorism which threatens the vulnerable OT (Operational technology) systems. These include the hardware and software systems that monitor and control physical devices in the field. It goes without saying that securing these targets is a huge and a mammoth task that lies at each country\u2019s doorstep that possess any critical infrastructure. In this analysis, LMNTRIX focuses on the growing number of different and distinct cyber threats which we have seen over the past year targeting nuclear facilities backed by various state-sponsored threat actors. 

In order to understand the effective functions of the nuclear plant, the devices, functions, and its attributes need to be segregated using Purdue model: – 
<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n


Figure 1: Purdue Model of Nuclear Power Plant

The cyber threats observed on nuclear power plants mostly target the components associated with Level 1 & 2 of the Purdue model. We will refer to the Level 3 as the IT network (even though this is different from the enterprise network and ideally it is placed behind a DMZ) and Level 2 as the OT network from here on. Adversaries targeting Industrial Control systems (ICS) require more resources than any other type of adversary, as each ICS based organization is different in terms of systems used. These systems have varying operational processes that define acceptable and unacceptable outcomes for the PLC devices, valves, pumps, actuators, etc. The ICS Cyber Kill Chain breaks down the steps taken by an adversary into two stages. Identifying each part of these stages and considering them into threat modelling process will lead to a layered defence against ICS attackers.

The Stage 1 of ICS Cyber Kill Chain is similar to the traditional Cyber Kill Chain as the objectives and goals are similar, namely, of gaining access to information; defeating existing defensive measures; gain access to protected network segments; exfiltrate data; and maintain undetectable access to infected systems.

 <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n



Figure 2: ICS Cyber Kill Chain, Stage 1, SANS (SANS, 2015)

In Stage 2, the attacker uses information gained from Stage 1 to develop, test, and execute the attack. Often an adversary fails in Stage 1 due to the sensitive nature of the equipment connected to the network causing unintended outcomes for an attacker. State-sponsored attackers are capable of successfully reaching Stage 2, because they might often get to either a test network in their home country or exfiltrate system specific information to successfully develop working malware.

 <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n



Figure 3: ICS Cyber Kill Chain, Stage 2, SANS (SANS, 2015)<\/em>

Before we move further, it is important to establish what is considered as an ICS attack. Although attacks on ICS organizations may involve theft of operational data or the infection of systems. The functional impact of such an attack on daily operations or degradation in safety involving harm to system devices, plant workers, or field personnel of an ICS organization is defined as an ICS Attack (SANS, 2015). This can be further broken down into three categories:<\/p>\n\n\n\n