The Radiflow Security Blog

The cat photo that disabled production: steganography in OT cyber-attacks

By Michael Langer, Chief Product Officer, Radiflow 

July 20, 2020

The use of steganography in OT cyber-attacks

The practice of steganography—concealing messages or information within text or data—is far from new (during the cold war, newspapers and radio shows were regularly used to send coded messages and instructions to spies behind enemy lines.) The modern day version, however, is used not to convey instructions to humans, but as a means of weaponizing seemingly benign files with malware.

In the context of cyber-attacks, steganography is often (but not always) used in conjunction with spear-phishing attacks. The attacker sends an email or other type of message, seemingly from a trustworthy contact, with an intriguing image or common computer file (e.g. spreadsheet or Word document), often accompanied by a call to action (“I couldn’t stop laughing!” or “You really should read this!”) Then, clicking on the image or opening the file triggers an executable containing malicious content.

Steganography enables the attackers to evade some security tools, including network traffic scanners. In the case of images, the malicious data (e.g. PowerShell script) is encoded within specific pixels in publicly hosted images (which makes detection by common network traffic scanners very difficult); in other cases, downloading a file, e.g. MS Word or Excel file, will prompt the user to allow active content (macros) on the document, which, in turn, will activate a malicious payload.

The nefarious payload itself, if gone undetected, can wreak havoc on both sides of the IT-OT divide: it can change SCADA systems’ operating values or change logics in networked device; on the IT side the malware can open a C&C channel for exfiltrating sensitive corporate data.

According to Kaspersky, up to 50% of steganography attacks targeted industrial organizations. Some of the attacks took advantage of the network interconnectivity between the organization and its smaller vendors/suppliers (which may have weaker protections or email safety policies).  By harvesting vendors’ employees’ credentials, attackers are able to remotely wreak havoc on the larger organization’s network.

Workflow of steganography-based cyber-attacks (source: Kaspersky)

This newly-discovered campaign against hardware & software suppliers to industrial enterprises again sheds light on the cyber risk originating from enterprises’ supply chains and partners.

Many sources speculate that these attacks were state-sponsored.

Such attacks may serve a number of purposes:

  • First and foremost, economic espionage.
  • Secondly, it could be used to get deep insights into software/hardware design and find zero-day vulnerabilities that can be then exploited in attacks against enterprises that use these products.
  • Thirdly, one of major and more common techniques for highly-skilled hackers is to embed a malware or a backdoor in this type of product for later use at their deployments (as was the case in CCleaner and NotPetya)
  • Finally, the stolen suppliers’ credentials can be used for initial access into to their customers’ networks during periodic maintenance and service (like in the famous “Cloud Hopper” campaign)

Prevention & Mitigation

Preventing steganography-based cyber-attacks requires both making sure that employees don’t activate the hidden malware (e.g. by opening a photo or allowing macros in MS Office documents) and, as a second line of defense, had an employee activated the malware, detecting the network activity triggered by the malware.

  • Network segmentation and segregation: one of the key structural changes all industrial organization should implement is maintaining separation between operational and IT networks using firewalls and DMZs.
  • Human/social engineering: this activity involves employee training on what steganography and phishing attacks are, what to look for in illegitimate emails, procedures for reporting to IT department, etc. (some organizations actually hold phishing-preventing exercises for senior/sensitive position-holders, and even penalize employees for not following email safety guidelines)
  • Detection by an IDS: while files containing hidden malware can’t always be detected prior to human activation, Intrusion Detection Systems (IDSs) such as Radiflow’s iSID are able to detect minute changes in network behavior that indicate the triggering and the propagating of malware such as connecting to a previously unused hosting server, opening new external connections, unusual data traffic patterns.


The slew of attacks described above yet again demonstrates that it is imperative that stakeholders in industrial enterprise cyber security (CISO, OT security manager, Chief Risk officer) manage their organization’s cyber risk properly, validate the security posture of suppliers, monitor 3rd-party network access, and deploy threat detection tools at the production lines to alert on possible exploits

There’s no magic bullet that can prevent steganography-based cyber-attacks prior to activation of the hidden malware contained in the carrier medium. An effective security plan should involve segregating between OT and IT networks (using firewalls & DMZs); raising awareness and educating employees; and installing an IDS (such as Radiflow iSID) that is able to instantly detect network behavior patterns indicating a malware attack.

Michael Langer
Chief Product Officer, Radiflow

A renowned cyber warfare expert, Michael Langer brings over 20 years of experience in leading cyber defense initiatives for the Israeli Defense Forces (IDF) and in defending national-grade information, telecom and other critical infrastructures.

Prior to joining Radiflow, Michael held multiple leadership positions in the IDF’s Cyber Security Technology Center, including Head of the Cyber Incident Response Team (IDF CERT), Head of Cyber Security R&D and Operations Branch and Chief Cyber Security Architect, where he played a critical role in developing the security for the IDF’s Cloud Platform and defining the cybersecurity roadmap for the IDF’s Digital Transformation program.

Michael holds an MBA and a B.Sc. in Computer Science from the Technion Israel Institute of Technology, and has been CISSP-certified since 2007.