Ransomware ‘likely’ to target transportation OT systems, warns EU cyber agency

Ransomware attacks have become the most significant cyberthreat facing the transport sector in the European Union, according to new analysis published Tuesday. The 50-page report from the European Union Agency for Cybersecurity (ENISA) is the first analysis the agency has conducted into the threats facing the aviation, maritime, railway and road sectors. It warns that while the majority of ransomware attacks to-date have targeted information technology (IT) systems such as databases, ransomware groups “will likely target and disrupt” operational technology (OT) systems “in the foreseeable future,” potentially causing even more significant effects for victims. OT systems typically monitor or direct mechanical processes, making them particularly important for the safety of airports, ports, rail traffic and other aspects of the transport sector. ENISA said that it has not received “reliable information” on such a cyberattack actually affecting the safety of transport, but that the risk of attacks on OT systems is growing due to digital transformation integrating the historically compartmentalized IT and OT systems. The assumed urgency of the transport sector “to pay ransom to avoid any critical business and social impact” could also be driving more attacks, the agency assessed. While the majority of attacks on the transport sectors in 2022 were conducted by criminals with a financial motive, state-sponsored groups appeared particularly interested in the maritime sector. Attacks on ports in Europe, India and Iran have taken place in recent years for a range of purposes — from criminal ransomware attacks through to potential conflict pre-positioning and apparent retaliation among rival states. Earlier this month, the U.S. Transportation Security Administration handed down new emergency cybersecurity protocols for airports and aircraft operators “because of persistent cybersecurity threats against U.S. critical infrastructure, including the aviation sector.”

https://therecord.media/transportation-ransomware-european-union-enisa-report