The Renaissance of Cyber Physical Offensive Capabilities
summary
Malware named Cosmic Energy targets electric grids by speaking IEC 104 to RTUs, deploying a second-stage module Light Work that toggles breakers and can disrupt power, dropped via compromised MSSQL hosts. Sample appears in a Russian-submitted sandbox, has development bugs, and reads like a contractor red team tool tied to Ros Telecom’s “solar polygon” tests. Historic links to Industroyer and Triton show reuse patterns, rising use of Python and open source protocol libraries, and a clear lowering of barriers to OT offensive capabilities.
AI-written summary · about
chapters (9)
- 0:00Cyber physical offensive intro
- 3:57OT ICS threats evolution
- 7:33CosmicEnergy malware analysis
- 15:47CosmicEnergy red teaming tool
- 21:03CosmicEnergy threat significance
- 24:37Rising OT system vulnerabilities
- 27:45OT malware detection methods
- 32:19Future of OT cyber threats
- 35:30Q&A on AI and OT attacks
related talks
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators
33mIndustroyer: biggest threat to industrial control systems since Stuxnet
47mThe Blurred Lines between Cybercrime and Statecraft
42mKeynote: The Expanding Universe of Cyber Threats
23mGreyEnergy: Beyond BlackEnergy and NotPetya
18mBehind enemy lines
42mCloudy With a Chance of Exploits: Compromising Critical Infrastructure Through IIoT Cloud Solutions
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA