The US Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Energy published joint guidance on mitigating cyber attacks against uninterruptible power supply (UPS) devices.
The US agencies warn of threat actors gaining access to a variety of internet-connected uninterruptible power supply (UPS) devices by exploiting default credentials.
UPS devices provide clean and emergency power in a variety of applications when normal input power sources are interrupted for various reasons.
The guidance recommends organizations immediately enumerate all UPSs and similar systems and ensure they are not accessible from the internet. In the case where a UPS device must be accessible online, organizations are recommended to implement the following controls:
CISA recommends checking if organizations’ UPS credentials are still set to the factory default.
Additional info, including incident response best practices, are included in the “Mitigating Attacks Against Uninterruptible Power Supply Devices” guidance.
(SecurityAffairs – hacking, BazarLoader)