The devastating power cut that left tens of millions of people across South America without an electricity supply on Sunday is not being treated as a cyberattack – but comes as nation state-backed attackers are increasingly targeting countries’ power supplies.
The incident, which is being described as the worst in history in the region, saw almost all power supplies in Argentina and Uraguay taken offline, with regions of Paraguay and Chile also impacted.
Go deeper with GlobalData
It is not yet clear what caused the unprecedented South America power cut, but officials have said that they are not looking at a cyberattack.
“At this moment we do not rule out any possibilities but… a cyberattack is not within the preliminary alternatives being considered,” said Argentinian energy secretary Gustavo Lopetegui in a press conference on Sunday, as reported by CNN.
However, the vast power outage has come at a time when cyberattacks on power infrastructure is on the rise – often enacted by groups thought to be backed by nation-states.
Cyberattacks on power infrastructure on the rise
Industrial targets are proving increasingly popular for cyberattackers, with electricity infrastructure increasingly being chosen by hacking groups, many of whom have links to governments.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataOne such example is Xenotime, a hacking group that has previously targeted oil and gas infrastructure, which has recently focused on the US power grid.
Xenotime is infamous for being behind the Triton malware, which was designed to disable safety systems at a Saudi Arabian oil refinery in a bid to create physical damage to the structure.
Now cybersecurity company Dragos has determined that the group has expanded beyond its initial focus, and has made early explorations of at least 20 targets within the US electric system, taking advantage of increasingly sophisticated industrial control systems (ICS) within the network.
“Industrial control system (ICS) cyber threats are proliferating. More capable adversaries are investing heavily in the ability to disrupt critical infrastructure like oil and gas, electric power, water, and more,” wrote Dragos of the threat.
“Attacking any industrial sector requires significant resources, which increases as capabilities and targeting expand. The high resource requirement previously limited such attacks to a few potential adversaries, but as more players see value and interest in targeting critical infrastructure – and those already invested see dividends from their behaviours – the threat landscape grows.”
It is not known with certainty if Xenotime is backed by a nation-state, but the organisation has been previously linked with a state-backed Russian research institute.
South America power cut shows potential impact of cyberattack
Although it is not currently being treated as a cyberattack, the South America power cut does demonstrate the type and severity of damage that could be achieved by hackers equipped with the right tools.
For those in the power industry, it also underscores how important security is – and how organisations should review their systems to ensure they aren’t unwittingly allowing attackers to gain entry.
“With digital sensors and computing devices within industrial plants having life-spans far exceeding those of commercial devices, a comprehensive patch management strategy designed with a detailed understanding of the software supply chain powering these devices is a critical component of ongoing threat mitigation,” said Tim Mackey, principal security strategist at Synopsys CyRC (Cybersecurity Research Center).
“This strategy should be based on a detailed software asset inventory which includes not only specific applications or control system device firmware, but also any dependencies on external components.”
Read more: NotPetya, WannaCry: The privatisation of nation-state capabilities threatens us all
