Comprehensive Study of ICS Malware Attacks & Prioritizing Critical Defenses Using MITRE ATT&CK

It is commonly acknowledged that attacks on Industrial Control Systems (ICS) can result in far greater negative impact on the target organizations as well as the general public relative to attacks on Enterprise IT systems. Among attacks on ICSs, those involving specialized malware are particularly concerning as they tend to be orchestrated by advanced nation-state actors, and are often aimed at producing tangible physical and/or operational damage. The goal of our research is to conduct a comparative analysis of all ICS malware strains known to-date, in the context of the MITRE ATT&CK framework. We generally distinguish between two main groups of ICS malware – those that aim to cause a significant operational impact (high-impact ICS malware) vs. those that only aim to halt the operation of the target system for purely financial reasons (ICS ransomware). For the purposes of our analysis, we propose and deploy a novel technique for prioritization/ranking of mitigation and detection strategies based on their overall effectiveness against a particular group/type of attacks. Our analysis shows that: a) each ICS malware group is associated with an entirely unique set of top-5 (i.e., top-4) adversary techniques, and b) when it comes to detection and mitigation of high-impact ICS malware strains, network-based defenses play an especially critical role, though their significance in dealing with ICS ransomware is also notable. These findings not only contribute to better general understanding of ICS malware strategies, but are also intended to guide the development of more cost-effective and better-tailored cyber-defenses in real-world ICSs.