James Scott, a senior fellow at the Institute for Critical Infrastructure Technology, said these so-called attacks constituted "show-of-force intelligence gathering and cyber-kinetic sabotage malware attacks against US Energy infrastructure".
He added that these attacks were "neither novel nor warrant mass-hysteria attempts by fearmongers seeking to exploit the incident for personal gain".
Last week, Symantec issued a detailed blog post in which it claimed a group, known as Dragonfly, had been carrying out three types of attacks: phishing emails sent to employees of energy companies, bids to attract these individuals to watering holes that were infected, and the use of malicious emails to obtain network credentials.
|
In a blog post, Scott said Dragonfly, which he described as an Eastern European threat actor also known as Energetic Bear, had targeted the defence and energy industries, and ICS equipment manufacturers from 2011 to 2014 in a manner that was suggestive of a state sponsor.
"Dragonfly specialises in targeting organisations with lackadaisical cyber security, cyber hygiene or IT-OT separation and tangential third-party networks that could be compromised as part of lateral-access attacks," Scott wrote.
But he said that the possibility of credible cyber kinetic sabotage attacks, while legitimate, were diminished by the distributed nature of the US energy grid.
"The redundancy systems in place, and the likelihood that the sophisticated adversary could adequately anticipate and prudently avoid the attentive response of US intelligence services" were other mitigating factors, he pointed out.
Scott said if Dragonfly was a Russian state-sponsored group, then the compromises could be a show-of-force meant to indirectly respond to recent sanctions placed on the sponsor.
"If the group is mercenary, the campaign could be a demonstration of skill. In either case, while the capability exists, actual cyber-kinetic impacts similar to the Black Energy malware attacks against Ukraine, would do little other than draw the ire of the US and its allies," he said.
"Considering that Energetic Bear has only just re-emerged, the likelihood that it would substantiate an attack that would necessitate its immediate dispersion is minimal."