SCADA Ransomware Attack - Proof of Concept

The proof of concept attack, named Scythe targets various I/O devices which offer a web server capability. The details around which devices or vendors are affected by Scythe have yet to be released to allow the industry time to implement mitigation by way of patches or other remedial action where appropriate.

The attack itself is described as being slightly different for each device and would require the attacker to gain physical access to a vulnerable device to begin hardware reverse engineering activity to enable the attack to work.

The technical details of the attack are being closely guarded for now but it is known that the attack relies on a firmware validation bypass which allows legitimate firmware to be replaced with malicious firmware which causes the device to function improperly. When a technician accesses the device to troubleshoot functionality, they would then be presented with a ransom note. If the ransom is not paid, the firmware will be corrupted and any configuration files would be overwritten.

It should be noted that this is not the only use case of SCADA systems for attackers. With full access to a device, the operation could be modified, not just to cause denial of service but even to the point of causing physical damage to equipment.