Critical infrastructure, which is operated by operational technology (OT) consisting of hardware and software used to manage physical assets like industrial equipment or building management systems, remains a prime target of USB-derived cyber threats, as reported by Honeywell in the USB Threat Report.
The report highlighted the need for OT environments to enhance their cybersecurity measures, given the increasing frequency and sophistication of cyberattacks on industrial sites over the years. Specifically, the study focused on malware found on USB storage devices used to transfer files within and between industrial facilities.
Cyberattackers are becoming more adept at understanding the operations of industrial environments, allowing them to potentially cause greater damage. Instead of exploiting vulnerabilities, many intruders are using USB devices to surreptitiously infiltrate industrial control systems and observe operations before launching attacks that exploit the system’s inherent capabilities.
With a growing number of malware attacks specifically targeting systems within industrial facilities, the report revealed that 31% of malware attacks are aimed at industrial systems and sites. This percentage has been rising steadily since 2016 when only 16% of malware attacks were industrial-focused.
The impact of malware on OT environments can be severe, leading to the loss of visibility, loss of control, or system outages that can significantly disrupt industrial operations. Honeywell’s research indicated that 82% of malware has the potential to disrupt industrial operations by either compromising visibility or control.
The report also noted a significant increase in the use of removable media, particularly USBs, in targeted attack campaigns. Over half (51%) of malware attacks are now designed for USB devices, which represents a nearly six-fold increase from the 9% reported in the 2019 edition of the report.