Among every state-sponsored hacking group that has attacked the U.S power grid, and went beyond to compromise American Electric Utilities, only Sandworm, a Russian Espionage group, has been bold enough to activate real blackouts, compelling lights shutdown in Ukraine in 2015 and 2016. A firm that emphasizes grid security has issued a warning that a criminal group that has links to Sandworm's highly sophisticated hackers has been successfully attacking US energy systems and it's been years.
Wired reports, "Dragos ties Kamacite to electric grid intrusions not just in the US, but also to European targets well beyond the well-publicized attacks in Ukraine. That includes a hacking campaign against Germany's electric sector in 2017."
Recently, Dragos, an industrial cybersecurity firm issued its yearly report on the current state of industrial controls systems security. The report has identified four new foreign criminal groups which target these critical infrastructure systems. Three of these four groups have attacked US industrial control systems.
However, the most notorious group is Kamacite, according to Dragos. The group, says Dragos, may have worked with Gru's Sandworm. In the past, Kamacite has worked as Sandworm's access team. Experts believe it emphasized getting a stronghold in the victim network before giving access to other Sandworm hacking groups. These groups, in turn, have performed the cyberattacks. As per cybersecurity agencies, Kamacite has targeted US electric utilities, gas and oil, and other organizations on various occasions. These attacks date back to 2017.
Experts believe that the group is continuously attacking the US electric utility sector to maintain a presence of a threat.
In few incidents over the years, the group has successfully managed to breach US target networks, which allowed them to gain access to the utilities.
Sergio Caltagirone, Dragos vice president of threat intelligence and former NSA analyst says that "if you see Kamacite in an industrial network or targeting industrial entities, you clearly can't be confident they're just gathering information. You have to assume something else follows. Kamacite is dangerous to industrial control facilities because when they attack them, they have a connection to entities who know how to do destructive operations."
