13/01/22

Critical Infrastructure Daily Brief

Statewide Terrorism & Intelligence Center

Critical Infrastructure Daily Brief

**UNCLASSIFIED **

(U) STIC is providing this information to our partner agencies for situational awareness. This document contains information obtained from open source information. While STIC has gone to great lengths to verify the information found in open source documents on the internet, this information may not be accurate.

 

Situational Awareness

A slew of billion-dollar weather and climate disasters struck the United States again last year, with Illinois affected by the costliest winter storm on record, according to an annual report from the National Oceanic and Atmospheric Administration. Last year had the second highest number of billion-dollar disasters on record and was the third costliest, based on records going back to 1980 and adjusted for inflation. In the 20 disasters that cost at least a billion dollars in 2021, at least 688 people were killed — the most fatalities since 2011 and more than double 2020 deaths. The 20 disasters — including a winter freeze, wildfire, drought, floods, tornadoes, hurricanes and severe weather — caused about $145 billion in damages overall. The costliest of the year was Hurricane Ida, at $75 billion, which made landfall in Louisiana in August with 150 mph winds. Along with warming temperatures, climate change caused by human actions makes extreme weather more likely and more intense, scientists say. In the last five years, 86 disasters have cost a record $742 billion. In 2020, a record-breaking 22 disasters struck the country, including the costly and deadly derecho that downed trees and rattled windows from Iowa to Chicago. When records began, the country averaged a few billion-dollar disasters a year. Illinois was affected by seven billion-dollar disasters in 2021, including a February storm and cold wave. In Texas, where the freeze led to massive power outages, more than 200 deaths were related to the disaster. At $24 billion, it ended up as the costliest winter storm on record, topping the March 1991 “Storm of the Century” that wreaked havoc as it traveled across the country, spurring more than a dozen tornadoes in Florida and dropping feet of snow in some northeastern locations. Illinois ended up with its 11th coldest February on record, going back to 1895, and some southern parts of the state recorded their coldest February. Illinois was also affected by severe storms in spring and summer, as well as the December tornado outbreaks that led to six deaths at an Amazon facility in Edwardsville.

 

Shortages at U.S. grocery stores have grown more acute in recent weeks as new problems — like the fast-spreading omicron variant and severe weather — have piled on to the supply chain struggles and labor shortages that have plagued retailers since the coronavirus pandemic began. The shortages are widespread, impacting produce and meat as well as packaged goods such as cereal. And they’re being reported nationwide. U.S. groceries typically have 5% to 10% of their items out of stock at any given time; right now, that unavailability rate is hovering around 15%, according to Consumer Brands Association President and CEO Geoff Freeman. Part of the scarcity consumers are seeing on store shelves is due to pandemic trends that never abated - and are exacerbated by omicron. Americans are eating at home more than they used to, especially since offices and some schools remain closed. The average U.S. household spent $144 per week at the grocery last year, according to FMI, a trade organization for groceries and food producers. That was down from the peak of $161 in 2020, but still far above the $113.50 that households spent in 2019. A deficit of truck drivers that started building before the pandemic also remains a problem. The American Trucking Associations said in October that the U.S. was short an estimated 80,000 drivers, a historic high. And shipping remains delayed, impacting everything from imported foods to packaging that is printed overseas. Retailers and food producers have been adjusting to those realities since early 2020, when panic buying at the start of the pandemic sent the industry into a tailspin. Many retailers are keeping more supplies of things like toilet paper on hand, for example, to avoid acute shortages.

 

Cybersecurity

Attackers are leveraging Adobe Creative Cloud to target Office 365 users with malicious links that appear to be coming legitimately from Cloud users but instead direct victims to a link that steals their credentials, researchers have discovered. Researchers from Avanan, a Check Point company, first discovered the ongoing campaign in December when they stopped one of the attacks, according to a report published Thursday. Adobe Creative Cloud is a popular suite of apps for file-sharing and creating and includes widely used apps such as Photoshop and Acrobat. Though attackers are primarily targeting Office 365 users – a favorite target among threat actors – researchers have seen them hit Gmail inboxes as well, Jeremy Fuchs, cybersecurity research analyst at Avanan, told Threatpost. The attack vector works like this: An attacker creates a free account in Adobe Cloud, then creates an image or a PDF file that has a link embedded within it, which they share by email to an Office 365 or Gmail user. “Think of it like when you create a Docusign,” Fuchs explained to Threatpost. “You create the document and then send it to the intended recipient. On the receiving end, they get an email notification, where they click to be directed to the link.” Though the links inside the documents sent to users are malicious, they themselves are not hosted within Adobe Cloud but, rather, from another domain controlled by attackers, he added.

 

The Lazarus, Cobalt, and FIN7 hacking groups have been labeled as the most prevalent threat actors striking financial organizations today. According to "Follow the Money," a new report (.PDF) published on the financial sector by Outpost24's Blueliv on Thursday, members of these groups are the major culprits of theft and fraud in the industry today. The financial sector has always been, and possibly always will be, a key target for cybercriminal groups. Organizations in this area are often custodians of sensitive personally identifiable information (PII) belonging to customers and clients, financial accounts, and cash. They also often underpin the economy: if a payment processor or bank's systems go down due to malware, this can cause irreparable harm not only to the victim company in question, but this can also have severe financial and operational consequences for customers. PII for identity theft, bank accounts to make fraudulent purchases, a high probability a financial firm would rather submit to a ransomware blackmail demand rather than disrupt operations: these potential attack vectors mean that it is no surprise cyberattackers are relentless in their quest to compromise players in the sector. The COVID-19 pandemic, and the disruption to operations and training it has caused, has only made the situation worse. Blueliv's whitepaper, based on the unit's threat intelligence gathering, outlines the main ways in which financial entities are targeted. Phishing, Business Email Compromise (BEC) scams, malware, and credential theft all make an appearance: of which Azorult, Arkei, Redline, Raccoonstealer, and Collector are the top five credential stealers as of October 2021.

 

Apple has released security updates to address a persistent denial of service (DoS) dubbed doorLock that would altogether disable iPhones and iPads running HomeKit on iOS 14.7 and later. HomeKit is an Apple protocol and framework that allow iOS and iPadOS users to discover and control smart home appliances on their network. As the company explained in a security advisory issued today, the doorLock vulnerability tracked as CVE-2022-22588 will crash affected iOS and iPadOS devices when processing maliciously crafted HomeKit accessory names. Apple has addressed this severe resource exhaustion issue in iOS 15.2.1 and iPadOS 15.2.1 by adding improved input validation which no longer allows attackers to disable vulnerable devices. Devices that received security updates today include iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).

 

Energy

A severely corroded pipeline ruptured and spilled more than 300,000 gallons (1.1 million liters) of diesel fuel just outside New Orleans after the operator delayed needed repairs, according to federal records. Most of the fuel drained into two artificial ponds called “borrow pits” and thousands of fish, birds and other animals were killed, state and local officials said Wednesday. The spill also contaminated soil, according to state and federal officials. The pipeline’s owner said 315,000 gallons (1.2 million gallons) of fuel with some water mixed in had been skimmed and recovered, primarily from the ponds. Cleanup work is ongoing. The spill from the 16-inch-diameter (40-centimeter-diameter) line operated by Collins Pipeline Co. was discovered Dec. 27 near a levee in St. Bernard Parish, just east of New Orleans, according to documents from the Pipeline and Hazardous Materials Safety Administration. The spill had not been previously publicly reported. An inspection of the 42-year-old Meraux Pipeline more than a year earlier, in October 2020, revealed external corrosion along a 22-foot (7-meter) section of pipe at the same site as the spill, federal records show. The pipe had apparently lost 75% of its metal where the corrosion was worst, which would have required immediate repair, according to the records. But work was delayed and the line continued operating after a second inspection concluded the corrosion was not bad enough to require immediate repair under federal rules, the records show.

Related Links


Back to index