Researches Detail 17 Malicious Frameworks Used to Attack Air-Gapped Networks

Four different malicious frameworks designed to attack
air-gapped networks were detected in the first half of 2020 alone,
bringing the total number of such toolkits to 17 and offering
adversaries a pathway to cyber espionage and exfiltrate classified
information.

“All frameworks are designed to perform some form of espionage,
[and] all the frameworks used USB drives as the physical
transmission medium to transfer data in and out of the targeted
air-gapped networks,” ESET researchers Alexis Dorais-Joncas and
Facundo Muñoz said^[1]
in a comprehensive study of the frameworks.

Air-gapping is a network security measure designed to prevent
unauthorized access to systems by physically isolating them from
other unsecured networks, including local area networks and the
public internet. This also implies that the only way to transfer
data is by connecting a physical device to it, such as USB drives
or external hard disks.

Given that the mechanism is one of the most common ways SCADA^[2] and industrial control
systems (ICS) are protected, APT groups that are typically
sponsored or part of nation-state efforts have increasingly^[3]
set their sights on the critical infrastructure in hopes of
infiltrating an air-gapped network with malware so as to surveil
targets of interest.

Primarily built to attack Windows-based operating systems, the
Slovak cybersecurity firm said that no fewer than 75% of all the
frameworks were found leveraging malicious LNK or AutoRun^[4] files on USB drives to
either carry out the initial compromise of the air-gapped system or
to move laterally within the air-gapped network.

Some frameworks that have been attributed to well-known threat
actors are as follows —

“All frameworks have devised their own ways, but they all have
one thing in common: with no exception, they all used weaponized
USB drives,” the researchers explained. “The main difference
between connected and offline frameworks is how the drive is
weaponized in the first place.”

While connected frameworks work by deploying a malicious
component on the connected system that monitors the insertion of
new USB drives and automatically places the attack code needed to
compromise the air-gapped system, offline frameworks like Brutal
Kangaroo, EZCheese, and ProjectSauron rely on the attackers
deliberately infecting their own USB drives to backdoor the
targeted machine.

As precautions, organizations with critical information systems
and sensitive information are recommended to prevent direct email
access on connected systems, disable USB ports and sanitize USB
drives, restrict file execution on removable drives, and carry out
periodic analysis of air-gapped systems for any signs of suspicious
activity.

“Maintaining a fully air gapped system comes with the benefits
of extra protection,” Dorais-Joncas said. “But just like all other
security mechanisms, air gapping is not a silver bullet and does
not prevent malicious actors from preying on outdated systems or
poor employee habits.”