Q3 2022 Energy Sector: Quarterly Threat Landscape Scorecard

Q3 2022 Energy Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-11-09b

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Energy Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

ZeroFox Intelligence assesses that the energy sector saw one of the biggest increases in threat of any sector in Q3 2022, with the ongoing war in Ukraine and subsequent economic crisis continuing to shape the cyber threat landscape. ZeroFox Intelligence assesses that the threat to the sector will continue to increase in the coming months, underpinned by politically-inspired targeting. In Q3 2022, there were likely increases in particular aspects of the social engineering threat to energy organizations, including from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online v2. (FIDO2) and certificate-based authentication. Exploit disclosure in Information Technology and Operational Technology infrastructure continued at a high pace, with threat actors leveraging vulnerabilities in past end-of-life products. The Initial Access Broker (IAB) market, which is underpinning the ransomware and digital extortion threat to energy firms, is shifting towards sales being made in private channels rather than advertising in open forums. This will likely make identifying and mitigating access sales ahead of compromise increasingly challenging. Botnet and malware deployment remained high, including infostealers and trojans. ZeroFox Intelligence has identified an increase in threat from ransomware and digital extortion, bucking a trend seen in other sectors, with a rise in attacks against “big game” energy targets. In coming months, the industry is likely to see an increase in politically-motivated extortion targeting.

Key Findings

• Energy organizations likely face an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
• Energy organizations continued to face a high risk of threat actors leveraging exploits in products past end-of-life use.
• IABs likely increasingly sold access to energy firms in the United States and Europe to ransomware operators via private channels, underpinning the increased threat the sector has faced from digital extortion.
• The ransomware and digital extortion threat to the energy sector likely increased, bucking an overall downward trend seen in other sectors.
• ZeroFox Intelligence assesses the threats facing the energy sector will more likely than not develop significantly over the next two quarters.