llustration: Aïda Amer/Axios
A hacker group believed to carry out some of the Iranian government's destructive attacks is focusing on makers of industrial control systems, according to a presentation a Microsoft employee will give at Thursday's CyberWarCon detailed in a new Wired article.
Why it matters: The group, nicknamed APT 33, Refined Kitten and Elfin, has been known to use malware to damage computer systems in the past, leading the Microsoft researcher presenting the talk on Thursday, Ned Moran, to speculate that the hackers may be laying the groundwork for future destructive attacks on industrial systems.
To be clear: The group has also been associated with traditional, fact-finding and source producing espionage as well. It's tough to guess the endgame of most hackers from their opening moves.
Industrial control systems, as the name implies, are the computerized systems that interface with pumps, fans and robots carrying out industrial tasks.
What they found: Moran told Wired that APT 33 has changed its tactics in recent months. In the past, the group had hacked systems by guessing passwords of employees at tens of thousands of different organizations at a time, but has now shifted to focusing on more employees at each of a smaller number—roughly 2,000—targets.
- Around half the top 25 targets were makers or maintainers of industrial systems.
APT 33 has a history of attacking aerospace and oil operations, as well as politicians, academics and the water source for a U.S. military facility.
- It has been connected to two strains of hard drive erasing "wiper" malware known: ShapeShift and Shamoon. Shamoon has been used in some of the most destructive cyber attacks in history, including an attack on Saudi Aramco.
Go deeper: Infamous Shamoon malware re-emerges.