U.S. warned of exploit in Ukrainian cyberattacks

A new report from Kaspersky Lab about the coordinated cyberattack over the Christmas holidays that took out sections of the Ukrainian power grid says the exploit might have appeared in the U.S. two years ago.

Cybersecurity experts say the offensive was the first cyberattack to take out a power grid.

The ability to turn a critical infrastructure cyberattack into a physical assault is among the biggest fears of security officials worldwide. Not surprisingly, cybersecurity protections for the energy grid are a top priority in the comprehensive energy bill -- the first in five years -- making its way through the Senate.

According to a Jan. 28 report by Kaspersky Lab's Global Research and Analysis Team, the attack on the Ukrainian power grid used email phishing and malware that harnessed Microsoft Word document attachments to infiltrate industrial control systems.

Kaspersky and other cybersecurity experts have said the Russia-linked BlackEnergy APT group is behind the attack.

The U.S. Industrial Control Systems Cyber Emergency Response Team warned in 2014 about BlackEnergy's use of Word and other Microsoft Office documents in a targeted campaign to infiltrate computer facilities at a U.S. academic institution, Western European governments, and energy and telecommunications companies.

ICS-CERT said BlackEnergy had successfully broken into numerous industrial control systems at U.S. electrical and water companies by exploiting Microsoft Windows and Word.

According to Kaspersky's report, the attacks in the Ukraine, which has been a favorite BlackEnergy target, showed a shift from Excel to Word attachments to spread the malware. That shift could mean the group has tweaked the malware to make it a more potent threat to the critical infrastructure sector.

"Interestingly, the use of Word documents (instead of Excel) was also mentioned by ICS-CERT, in their alert," the report states.

Another advanced persistent threat actor, called Turla, has begun using Word documents to drop malicious payloads, according to Kaspersky. "This leads us to believe that many of these attacks are successful and their popularity will increase," the report states.