Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Between June 2023 and April of 2024 the allegedly Ukrainian state-sponsored group Blackjack carried out a destructive attack utilizing their FuxNet malware against the Moskollektor company responsible for (among other things) monitoring water and sewage sensor networks in Moscow.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
the user manual suggests retrieving firmware updates via FTP from a Telnet or SSH shell on the serial converter itself... The iRZ RUH2 3G is similarly Linux-based and has the ability to push firmware updates via its web interface, though SSH shell access is possible too... FuxNet malware over either SSH or a proprietary sensor management protocol
The CERT-PL report mentions two cases of attackers connecting to IED's FTP service using default credentials in order to delete essential files... the attacker compromised them via SSH using root accounts with default credentials in order to subsequently wipe the filesystem.
The attacker compromised them via SSH using root accounts with default credentials in order to subsequently wipe the filesystem... Wipers can focus on erasing general or specific disk contents but also on structural metadata such as disk partition tables (MBR, GPT). | The easiest way to wipe raw disk contents or structure metadata... After raw disk access has been obtained, the disk can be wiped in several ways including: Simply overwriting its contents with any sort of pattern
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.