Honeywell's fight against USB-borne malware in critical facilities

Honeywell released its 2024 USB Threat Report, which provides new insight into how “silent residency” is an increasing cyber threat for industrial and critical infrastructure facilities.

In the report, Honeywell highlighted the growing risk of “living off the land” (“LotL”) attacks in which adversaries use USB devices to gain access to industrial control systems to hide and observe operations before launching attacks that evade detection and manipulate the target systems. 

LotL attacks

"Targeted cyber-physical attacks are more than zero-day exploits that take advantage of an unknown or unaddressed vulnerability," said Micheal Ruiz, Vice President of OT cybersecurity for Honeywell. 

He adds, "Instead, they are now also about silent residency – using LotL attacks to wait until there is an opportune moment to turn a system against itself."

Secure Media Exchange

Key findings in the report indicate that adversaries have a strong understanding of industrial environments

In its sixth year, the report underscores the severe risk USB-borne malware poses to industrial and critical infrastructure facilities. Key findings in the report indicate that adversaries have a strong understanding of industrial environments and how they operate. 

According to the report, most of the malware detected on USB devices by Honeywell’s Secure Media Exchange could cause loss of view or loss of control of an industrial process, a potentially catastrophic scenario for operators.

Advanced end-to-end technology

"As digital transformation and automation accelerate, so does the exposure to sophisticated and malicious cyberattacks that can have devastating consequences in terms of reputation, safety, and continuity," said Micheal Ruiz.

He continues, "There are numerous ways a bad actor can infiltrate an OT environment, including through USBs. With Honeywell’s advanced end-to-end technology and deep experience, we partner with our customers to improve their ability to protect their assets and data from these threats."

Additional key findings 

The 2024 report is based on the Honeywell Global Analysis, Research, and Defense (GARD) team’s tracking and analysis of aggregated cybersecurity threat data from hundreds of industrial facilities globally during 12 months. 

Several of the report’s additional key findings included: 

• USB devices continue to be used as an initial attack vector in industrial environments, as 51% of malware is designed to spread via USB, a nearly six-fold increase from 9% in 2019.
• Content-based malware, which uses existing documents and scripting functions maliciously, is on the rise, accounting for 20% of malware. 
• Over 13% of all malware blocked specifically leveraged the inherent capabilities of common documents, such as Word, Excel, and PDF documents. 
• 82% of malware is capable of disrupting industrial operations, resulting in loss of view, loss of control, or system outages in OT environments.