The increasing reliance on digital infrastructure makes critical sectors like utilities more susceptible to cyberthreats. This concern has been highlighted by Kaspersky's recent discovery of a new SystemBC variant that has targeted a South African nation's critical infrastructure. This backdoor was found alongside Cobalt Strike beacons which are reminiscent of the 2021 Darkside Colonial Pipeline incident. Furthermore, Kaspersky research shows that malware was detected and blocked on 29,1% of Industrial Control System (ICS) computers in South Africa, in the first half of 2023. Looking more broadly at the continent, Africa sits in first place among other regions with the highest number of industrial systems under attack in H1 2023, where attacks were detected on 40,3% of ICS computers, with the energy sector being the top industry under attack (45,9%).
South Africa is currently in the throes of persistent and varying stages of load shedding as a result of prevailing maintenance and upgrade constraints that continue to threaten the stability of the country’s power supply in the short-term. Contending with additional clear and present cybersecurity risks further compounds the pressure on this very infrastructure and those charged with keeping the lights on.
"Cybercriminal activity is constantly evolving. While there's a decline in the number of global attacks, we're witnessing a surge in Advanced Persistent Threats (APTs) that are more strategically targeted, especially towards sectors like critical infrastructure," says Brandon Muller, technology expert and consultant for the MEA region at Kaspersky. "Such attacks are continuous, sophisticated, and when successful, can result in severe damage, financial loss, and extended downtime."
According to Kaspersky, threat actors are concentrating on specific targets to reap maximum benefits. The protection against these threats requires a layered approach. It begins with a focus on critical infrastructure protection: Kaspersky Industrial Cybersecurity solutions emphasise the need for strong cyber defences. Given the intricacies of cyberattacks on crucial sectors, businesses must stay updated with endpoint protection solutions, restrict VPN access where not needed, ensure backup copies are stored on dedicated servers, and consider implementing Endpoint Detection and Response-type (EDR) security solutions for both IT and OT networks. Kaspersky also recommends Managed Detection and Response (MDR) services for immediate access to top-tier security expertise.
The next evolutionary step in cybersecurity is Cyber Immunity. Kaspersky’s Secure by Design ideology underscores the need to think about security right from the design phase. By understanding specific security requirements for each project, businesses can create truly secure systems. A foundational understanding of security goals and assumptions is vital.
The utilities sector is undergoing unprecedented change. Digital transformation, decarbonisation, renewables, and regulatory challenges are shaping its future.
"South Africa's utilities sector is the lifeblood for many industries. The rapid changes, both in terms of digital transformation and the shift towards renewables, are commendable. However, cybersecurity cannot be an afterthought. The blend of innovative technology and top-tier security solutions is the key to ensuring uninterrupted services," Muller added.
By shedding light on these growing concerns and providing actionable insights, Kaspersky is reinforcing its commitment to strengthening future protection, neutralising current threats, and ensuring round the clock data protection and business continuity.
