Beyond botnets: Autonomous Firmware Zombie Attack in industrial control systems

This paper introduces a novel cyberattack vector called the ”Autonomous Firmware Zombie Attack.” Unlike traditional zombie attacks that rely on botnets and direct network control, this method enables attackers to covertly modify the firmware of substation Intelligent Electronic Devices (IEDs) and other firmware-based appliances, including critical industrial equipment, without requiring an active network connection, leaving minimal trace and making an offensive attack with only one infected device instead of a set of multiple devices in botnets. Unlike conventional cyber threats, this method allows attackers to manipulate devices to cause substantial damage while leaving minimal trace, thus evading traditional detection techniques. This study demonstrates the potential of the Autonomous Firmware Zombie Attack (AFZA), which causes substantial damage while evading conventional detection techniques. We first run such an attack on a series of IEDs as proof of concept for this issue. Then, we compare this approach to traditional remote control attacks, highlighting its unique advantages and implications for industrial control system security. This research underscores the critical need for a robust cybersecurity framework tailored to industrial control systems and advances our understanding of the complex risk landscape threatening critical infrastructures.