The U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Department of Energy (DOE) have issued a joint cybersecurity advisory (CSA) on two intrusion campaigns conducted by state-sponsored Russian cyber actors against U.S. and international energy sector organizations. The CSA stated that the attacks occurred between 2011 and 2018 and highlighted the historical tactics, techniques, and procedures (TTPs) used by adversaries. It also warned of the ongoing threat posed by state-sponsored Russian cyber operations to U.S. energy sector networks and set out best practices for securing industrial control systems (ICS) with mitigations intended to harden corporate enterprise networks.
