Why Critical Infrastructure Remains a Ransomware Target

There continues to be a lot of pressure on security leaders to do more with less, but today’s sophisticated and frequent cyberattacks only exacerbate the situation. And the bad news is these cyber incidents, particularly ransomware attacks, are not going away any time soon. In fact, they are becoming more prevalent in areas like critical infrastructure, supply chain, and financial institutions. For example, the Cybersecurity and Infrastructure Security Agency (CISA) observed ransomware incidents against 14 of the 16 US critical infrastructure sectors in 2021.

As one of the fastest growing types of cybercrime, the financial implications of ransomware have become more pronounced in recent years. These attacks cause more widespread damage than other single-target attacks, so it makes sense that we are seeing an increased response from government and technology vendors to fight off ransomware events. Is it enough?

RVWP: An Important First Step

In March 2022, CISA launched the Ransomware Vulnerability Warning Pilot (RVWP) program aimed at helping critical infrastructure organizations protect their systems against ransomware attacks by fixing vulnerabilities. While a good first step, to fully protect against ransomware and other cyberattacks, organizations need a security plan with multiple layers that includes technology measures, employee training, and well-defined and enforced security policies. However, it’s clear that not all critical infrastructure providers employ best security practices, which is why the RVWP was initiated. But it doesn’t go far enough.

While ransomware operators will absolutely take advantage of newly discovered vulnerabilities to infect targets, these are attacks of opportunity. Widespread network exploitation events impacting critical infrastructure are relatively infrequent these days, although smaller-scale attacks against well-known vulnerabilities persist and still have some level of success.

It’s important to note that in the downtime between major vulnerability discoveries, ransomware operators most often use watering-hole attacks, spear phishing, malicious advertising, and other social-engineering tactics that exploit humans to gain a foothold in network environments. No amount of network scanning and reporting will mitigate these risks, so critical infrastructure will continue to be impacted by ransomware.

GootLoader: An Example of Malware’s Spread

To better understand the potential impact, take a look at GootLoader, a popular malware that gives threat actors initial access to the victim’s IT environment. GootLoader is a prime example of a ransomware tactic that can infiltrate an organization’s network, and no amount of preventative scanning can stop it. At a high level, GootLoader uses search engine optimization (SEO) poisoning to lure and infect victims and compromise legitimate WordPress websites. If a user clicks on one of these websites and deploys the malware, it gives the threat actors a foothold on the network.

GootLoader does not seem to specifically target critical infrastructure entities, but they should still be concerned. In monitoring GootLoader, we have tracked over 700,000 URLs injected with the malware, and those contain around 3.5 million phrases that someone might use in a keyword search. I did a quick search, and here is a partial list of terms seen in the GootLoader landing pages that someone working in critical infrastructure might search for:

• Advance Payment in Government Contracts
• Agreement on Government Procurement
• Aviation Service Agreement
• Bermuda Agreement Aviation
• Civil Aviation Agreement
• Electricity Meter Operator Agreement
• General Terms Agreement Aviation
• Georgia Utility Laws
• Joint Operating Agreement Oil And Gas
• Nuclear Power Construction Labor Agreement
• Oil And Gas Commercial Agreements
• Oil And Gas Confidentiality Agreement
• Oil and Gas Asset Purchase Agreement
• Service Agreement Oil And Gas
• Signature Aviation Cooperation Agreement
• Sustainable Aviation Fuel Agreement
• Texas Utility Laws
• Transportation Lease Agreement
• Types of Oil and Gas Joint Venture Agreements
• Utility Company Agreement
• Utility Easement Laws in Florida
• Utility Services Agreement
• What Is a Master Service Agreement Oil and Gas

Next Steps to Mitigate Risks

While protecting critical infrastructure may seem daunting, there are some critical first steps the industry can take now to become more cyber resilient and mitigate risks:

1. Training: In an ideal world, CISA would expand on the RVWP to provide free end-user training and phishing simulations to critical infrastructure providers through third-party security providers.
2. Improving search engines: The industry needs to encourage search engine companies to proactively search for and remove malicious ads and search results from their platforms. CISA could also implement a program to scan for and report malicious ads and search results directly to the responsible teams at the major search engines for rapid mitigation.
3. Understanding malware: Security teams need better insight into ransomware operations’ kill chain. For example, remapping dangerous file extensions to open in Notepad instead of executing an application can break the chain so that many types of malware cannot gain a foothold on the network.

Adding these measures could have a far greater impact on stopping the proliferation of ransomware than the current program alone.