Hackers can mean one thing, but hacker groups, especially notorious ones, can mean a whole lot of things.
One of the most notorious, is the Iranian hacker group called APT33, also known by the names Holmium, Refined Kitten, or Elfin. The group have successfully carried out some of the most disruptive cyberattacks, including wiping the computer networks in the Middle East as well as parts of the U.S..
At the CyberwarCon conference in Arlington, Virginia, Microsoft security researcher Ned Moran revealed the company's findings about the hacker group, saying that it has shifted its focus.
Previously, Microsoft analyzed this hacker group's activities, including how the group carried out password-spraying attacks on standard IT networks owned by tens of thousands of organizations.
But since at mid-October, the group has significantly decreased this kind of attack, down to just a couple of thousands, and increased the number of attacks targeting physical control systems used in electric utilities, manufacturing, and oil refineries to almost tenfold on average.
While the intentions of the hackers remained unclear to Microsoft, Moran suggested that the group starts to seek foothold to better carry out cyberattacks with physically disruptive effects:
As of its findings, Moran said that Microsoft hasn't seen direct evidence of APT33 carrying out a disruptive cyberattack, and rather engaged in mere espionage or reconnaissance.
But suggested that incidents like these have previously been done when hacker groups tried to set the groundwork for future attacks.
Analyzing the group's trace, Microsoft found multiple intrusions when the group used data-wiping malware known as Shamoon. This is similar to what McAfee had previously found back in 2018, when the security company said that the APT33, or a group pretending to be APT33, started deploying tweaked versions of Shamoon.
According to threat intelligence firm FireEye, APT33 also has used SHAPESHIFT, another malware capable of massive disruption.
Moran declined to name any of the specific industrial control system, companies or products targeted by the APT33. But warned that the group's targeting of those control systems suggests that Iran may be seeking to move beyond merely wiping computers.
Attacks on physical infrastructures are in the history of state-sponsored hacking, but disturbing in their effects. One of the most famous was back in 2010, when the U.S. and Israel jointly launched Stuxnet that destroyed Iranian nuclear enrichment centrifuges, which were used to produce enriched uranium.
This hacker group's change of focus, comes in time when Iran is experiencing a tense moment with the U.S.
