Zscaler reports massive rise in IoT, OT malware attack; underscoring need for improved zero trust security  

Cloud security firm Zscaler identified in its latest report a 400 percent increase in IoT and OT (operational technology) malware attacks year-over-year, underscoring the need for better zero trust security to protect critical infrastructures. The report uncovered that manufacturing and education sectors targeted the most, with education realizing a nearly 1000 percent rise in IoT malware attacks

In its report, titled ‘Zscaler ThreatLabz 2023 Enterprise IoT and OT Threat Report,’ the San Jose, California-headquartered vendor provides an in-depth look at malware activity over a six-month period, analyzing approximately 300,000 blocked attacks on IoT devices secured by the Zscaler Zero Trust Exchange platform. The high number of attacks on IoT devices represents a 400 percent increase in malware compared to the previous year. The increasing frequency of malware attacks targeting IoT devices is a significant concern for OT security, as the mobility of malware can facilitate movement across different networks, potentially endangering critical OT infrastructure.

ThreatLabz focused on understanding IoT device activity and attributes via device fingerprinting and analyzing the IoT malware threat landscape. As more industries, organizations and individuals continue to rely on internet-connected devices, the threat from malware and legacy vulnerabilities increases. By adopting a zero trust architecture, organizations can gain visibility into IoT device traffic and minimize IoT security risks.

“Weak enforcement of security standards for IoT device manufacturers coupled with the proliferation of shadow IoT devices at the enterprise level poses a significant threat to global organizations. Often, threat actors target ‘unmanaged and unpatched’ devices to gain an initial foothold into the environment,” Deepen Desai, global CISO and head of security research at Zscaler, said in a media statement. “To address these challenges, I encourage organizations to enforce zero trust principles when securing IoT and OT devices – never trust, always verify, and assume breach. Organizations can eliminate lateral movement risk by utilizing continuous discovery and monitoring processes to segment these devices.”

Consistent growth in attacks

With the steady adoption of IoT and personal connected devices, the report found an increase of over 400 percent in IoT malware attacks year-over-year. The growth in cyber threats demonstrates cyber criminals persistence and ability to adapt to evolving conditions in launching IoT malware attacks.

Additionally, research indicates that cybercriminals are targeting legacy vulnerabilities, with 34 of the 39 most popular IoT exploits directed at vulnerabilities that have existed for over three years. 

The Mirai and Gafgyt malware families continue to account for 66 percent of attack payloads, creating botnets from infected IoT devices that are then used to launch denial-of-service (DDoS) attacks against lucrative businesses. Botnet-driven distributed DDoS attacks are responsible for billions of dollars in financial losses across industries around the globe. In addition, DDoS attacks pose a risk to OT by potentially disrupting critical industrial processes and even endangering human lives.

Manufacturing top targeted industry, as education being taught a lesson

Manufacturing and retail accounted for nearly 52 percent of IoT device traffic, with 3D printers, geolocation trackers, industrial control devices, automotive multimedia systems, data collection terminals, and payment terminals sending the majority of signals over digital networks. However, the quantity of device traffic has created opportunities for cybercriminals, and the manufacturing sector now sees an average of 6,000 IoT malware attacks every week. 

Moreover, these substantial IoT malware attacks can disrupt critical OT processes, which are integral in many industrial manufacturing plants like automotive, heavy manufacturing, and plastic and rubber. This creates long-term challenges for security teams at manufacturing businesses but also demonstrates that industrial IoT holds a substantial lead in adopting unique IoT devices (nearly three times more than other sectors). This increase is critical as manufacturing organizations continue adopting IoT tools for automation and digitization of legacy infrastructure.

Education is another sector that suffered from outsized attention from cybercriminals in 2023, with the propagation of unsecured as well as shadow IoT devices within school networks providing attackers with easier access points. The wealth of personal data stored on their networks has made educational institutions particularly attractive targets, leaving students and administrations vulnerable. 

United States and Mexico are the most targeted

Findings show that the U.S. is a top target for IoT malware authors with 96 percent of all IoT malware distributed from compromised IoT devices in the U.S. In 2023, Mexico experienced the most infections, with 46 percent of all IoT malware infections. In fact, three of the top four most infected countries (Mexico, Brazil, and Colombia) are all Latin American countries.

Industrial Cyber News Desk

Industrial Cyber News Desk