SiegedSec claims cyber activities against GNSS, BACNet & ModBus systems

• Ransomware group: SiegedSec
• Sector: Technology
• Announcement date: December 8, 2023

SiegedSec claims cyber activities against critical systems

The ransomware group SiegedSec has announced that it has conducted cyber activities targeting specific technical infrastructures. According to a post made on a leak site, the group claims to have targeted systems involving GNSS, BACNet, and ModBus. This announcement, which was posted on December 8, 2023, follows a claimed attack date of November 26, 2023. The group has asserted that these activities were carried out in collaboration with @xAnonymousSudan.

In many modern cyberattacks, threat actors utilize leak sites to claim responsibility for their actions. These platforms serve as a public stage where groups announce their targets and the nature of their interference. While these announcements are claims made by the threat actors themselves, they often highlight the evolving nature of cyber threats targeting specialized industrial and building automation technologies.

Claims of infrastructure targeting

The SiegedSec group has specifically stated that its cyber activities were directed at Israeli infrastructure. The group's claims suggest a focus on highly specialized technological components that are vital to modern operations. Specifically, the post indicates that GNSS receivers, BACNet building automation networks, and ModBus industrial control systems may have been affected by their actions.

The group has provided support for its claims through the use of screenshots. These images appear to show technical intervention processes specifically targeting industrial control systems. Such imagery is often used by threat actors to demonstrate the depth of their access or the technical nature of their intrusion into operational environments.

Information regarding data and technical impact

Regarding the specifics of the breach, the listing provides no information regarding the specific volume or type of data that may have been leaked or stolen. There is no mention of a specific file count or the total size of any data sets. Furthermore, the group has not issued a ransom demand in this specific announcement.

The listing names no data types that were allegedly stolen or leaked. Instead, the focus of the announcement remains on the technical intervention within industrial control systems and automation networks.

Potential operational risks

The nature of the systems mentioned—GNSS, BACNet, and ModBus—suggests a potential impact on operational continuity. When industrial control systems and building automation networks are targeted, the primary risk involves disruptions to the operation of critical infrastructure components. Such interventions can lead to significant operational challenges and may introduce secondary risks, such as the potential manipulation of these systems.

In the broader context of cybersecurity, attacks on industrial control systems (ICS) and building automation are particularly concerning due to the physical-digital interface. When these systems are compromised, the impact can extend beyond data loss to the actual functioning of physical environments. Organizations operating in sectors that rely on these technologies must maintain robust security protocols to mitigate the risk of system outages or unauthorized manipulation.

Defensive considerations for critical sectors

While public information regarding the SiegedSec group remains limited, this activity highlights the necessity for organizations to review their security protocols. For sectors relying on industrial control systems and automation, maintaining operational continuity is a primary concern. Defensive strategies typically involve monitoring for unauthorized technical interventions and ensuring that automation networks are segmented from broader corporate networks to prevent lateral movement.

Regular audits of industrial protocols and the hardening of communication interfaces are standard practices to defend against the types of technical interventions described in such claims. As threat actors continue to target specialized infrastructure, the importance of proactive monitoring and rapid response to potential system manipulations remains a critical component of modern cybersecurity defense.