Sign up for our daily briefing
Make your busy days simpler with Axios AM/PM. Catch up on what's new and why it matters in just 5 minutes.
Catch up on coronavirus stories and special reports, curated by Mike Allen everyday
Catch up on coronavirus stories and special reports, curated by Mike Allen everyday
Denver news in your inbox
Catch up on the most important stories affecting your hometown with Axios Denver
Des Moines news in your inbox
Catch up on the most important stories affecting your hometown with Axios Des Moines
Minneapolis-St. Paul news in your inbox
Catch up on the most important stories affecting your hometown with Axios Twin Cities
Tampa Bay news in your inbox
Catch up on the most important stories affecting your hometown with Axios Tampa Bay
Charlotte news in your inbox
Catch up on the most important stories affecting your hometown with Axios Charlotte
llustration: Aïda Amer/Axios
A hacker group believed to carry out some of the Iranian government's destructive attacks is focusing on makers of industrial control systems, according to a presentation a Microsoft employee will give at Thursday's CyberWarCon detailed in a new Wired article.
Why it matters: The group, nicknamed APT 33, Refined Kitten and Elfin, has been known to use malware to damage computer systems in the past, leading the Microsoft researcher presenting the talk on Thursday, Ned Moran, to speculate that the hackers may be laying the groundwork for future destructive attacks on industrial systems.
To be clear: The group has also been associated with traditional, fact-finding and source producing espionage as well. It's tough to guess the endgame of most hackers from their opening moves.
Industrial control systems, as the name implies, are the computerized systems that interface with pumps, fans and robots carrying out industrial tasks.
What they found: Moran told Wired that APT 33 has changed its tactics in recent months. In the past, the group had hacked systems by guessing passwords of employees at tens of thousands of different organizations at a time, but has now shifted to focusing on more employees at each of a smaller number—roughly 2,000—targets.
- Around half the top 25 targets were makers or maintainers of industrial systems.
APT 33 has a history of attacking aerospace and oil operations, as well as politicians, academics and the water source for a U.S. military facility.
- It has been connected to two strains of hard drive erasing "wiper" malware known: ShapeShift and Shamoon. Shamoon has been used in some of the most destructive cyber attacks in history, including an attack on Saudi Aramco.
Go deeper: Infamous Shamoon malware re-emerges.