Malware variants that target operational tech systems are very rare – but 2 were found last year

Two new malware variants specifically designed to disrupt critical industrial processes were set loose on operational technology networks last year, shutting off heat to more than 600 apartment buildings in one instance and jamming communications to gas, water, and sewage network sensors in the other. Up until the discovery of these two, dubbed Fuxnet and FrostyGoop and both used in the Russia-Ukraine war, there were only seven known industrial control system (ICS) malware variants in existence. ICS-specific malware remains rare, and that's because attackers generally don't need to write code to disrupt industrial systems. It's much easier to target operational technology (OT) devices with botnets and other generic malware —  or simply abuse the native functionality of these industrial systems' environments. "In other words: if an electric system operator can open up a circuit breaker and de-energize a substation, so can an adversary using native functionality," according to Dragos CEO and co-founder Robert M Lee. "So when malware comes around, it's a pretty big deal, because there's only been seven of them in the history of ICS that we've been able to find." Dragos specializes in OT cybersecurity, and Lee was speaking to reporters about his company's annual year in review report. It turns out that 2024 was notable for several reasons, and most of them fall on the anxiety-inducing end of the security spectrum. Ransomware, for example, skyrocketed among ICS orgs, increasing 87...