SUMMARY
We are alerting you that we recently detected and eliminated a Russian malware attack on a commercial real estate building through our multi-dimensional managed service protection. We are linking the incident to Russia based on a bulletin about a specific malware threat from CISA naming the malware that we discovered.
ICYMI: Intelligent Buildings spotlights APC Smart-UPS TLStorm vulnerabilities that allow attackers to cause cyber and physical damage through undetected remote access.
Over 20 million APC Smart-UPS (or uninterruptible power supply) devices are currently deployed worldwide. These devices are widely used in Commercial Real Estate, banking, hospitals, data centers, and media. Armis security researchers found a flaw, dubbed TLStorm, that allows attackers to take over these devices remotely. TLStorm has two critical vulnerabilities:
2021 will be remembered as yet another unprecedented year for all of us.
Professionally and personally, everyone has had to continue to adapt to changes. Notwithstanding all of this, Intelligent Buildings has played a part in helping the industry establish the new normal while also achieving some important milestones.
Several of our executives were appointed to industry positions recognizing our continuing thought leadership.
We are excited about our growth coming out of the pandemic, with…
Additionally, we would like to congratulate a customer and friend Chip Pierpont upon his recent retirement for a highly impactful career with the General Services Administration (GSA).
Under Chip’s leadership, the GSALink program (the GSA’s national fault detection and diagnostics platform) has taken in 89-billion-point samples, with a $73 million total estimated cost impact in FY2021 alone, along with an industry-leading OT cybersecurity regiment.
Several other Intelligent Buildings customers and industry friends won awards at the 2021 Realcomm | IBcon conference
We would like to congratulate them and express our gratitude for the long-standing relationship we share and their role in the smart building industry.
From all of us at Intelligent Buildings, we look forward to a safe and exciting year ahead and wish our customers and partners all the best in 2022.
Keep up with us on LinkedIn, or contact us here.
Senators Gary Peters (D-MI) and Rob Portman (R-OH) on the Homeland Security Committee introduced
legislation on Tuesday, 9/28, requiring critical infrastructure, nonprofits, businesses with more than 50
employees, and state and local governments to report cybersecurity attacks. Critical infrastructureowners and
operators must report to the Cybersecurity and Infrastructure Security Agency within 72 hours if they are
experiencing cyberattacks. All others are required to notify the federal government within 24 hours if they make
ransomware payments.
In the first week of August 2021, DataBreaches.net was contacted by a threat actor who claimed they had penetrated and attempted to extort ENE Systems, an HVAC vendor. According to the threat actor, they still had access to ENE Systems’ networks and clients after ENE Systems became aware of the breach. One of these clients was Boston Children’s Hospital. ENE Systems allegedly claimed that, though they were aware of the breach, they were unconcerned about the risks it posed to their networks and clients.
ICYMI: Hard evidence of direct threat to commercial building control systems from Nation States.
Classified documents were allegedly obtained from Iran that revealed secret research on how cyber attacks could be used to destroy equipment or even kill people using operational technology. These documents reveal a particular interest in researching companies and activities in western countries, including the UK, France, and the United States. To be even more specific, Smart Buildings are identified as an attack vector. The documents list several building controls manufacturers, such as Honeywell, Schneider Electric, KMC, Siemens, and others. This signals that the Iranians are getting very specific on what to attack and how to attack it.
