ICS Threat Hunting

Recently a hacktivist group known as GhostSec has claimed on a public Telegram group that it has been able to encrypt an industrial remote terminal unit (RTU) router that features SCADA capabilities including support for industrial serial interfaces RS-232 and RS-485, and MODBUS protocol variations. In this session we are going to unfold the incident and discuss security implications.

Contributor:

Sharon Brizinov / Director of Security Research, Claroty
Sharon Brizinov leads the Vulnerability Research at Team82, Claroty Research. He specializes in OT/IoT vulnerability research, has participated in multiple Pwn2Own competitions, and holds a DEFCON black badge.

TLP Green

00:32:00