Nov 22, 2021 11:59 AM

Devious ‘Tardigrade’ Malware Hits Biomanufacturing Facilities

The surprisingly sophisticated attack is “actively spreading” throughout the industry.

Graphics illustration of network symbol dna strands factory and digital skulls

When ransomware hit a biomanufacturing facility this spring, something didn't sit right with the response team. The attackers left only a halfhearted ransom note, and didn't seem all that interested in actually collecting a payment. Then there was the malware they had used: a shockingly sophisticated strain dubbed Tardigrade.

As the researchers at biomedical and cybersecurity firm BioBright dug further, they discovered that Tardigrade did more than simply lock down computers throughout the facility. They found that the malware could adapt to its environment, conceal itself, and even operate autonomously when cut off from its command and control server. This was something new.

Today the cybersecurity nonprofit Bioeconomy Information Sharing and Analysis Center, or BIO-ISAC, of which BioBright is a member, is publicly disclosing findings about Tardigrade. While they're not making an attribution about who developed the malware, they say its sophistication and other digital forensic clues indicate a well-funded and motivated “advanced persistent threat” group. What's more, they say, the malware is “actively spreading” in the biomanufacturing industry.

“This almost certainly started with espionage, but it has hit on everything—disruption, destruction, espionage, all of the above,” says Charles Fracchia, BioBright’s CEO. “It’s by far the most sophisticated malware we’ve seen in this space. This is eerily similar to other attacks and campaigns by nation state APTs targeting other industries.”

As the world scrambles to develop, produce, and distribute cutting-edge vaccines and medications to combat the Covid-19 pandemic, the importance of biomanufacturing has been put on full display. Fracchia declined to comment about whether the victims do work related to Covid-19, but emphasized that their processes play a critical role.

The researchers found that Tardigrade bears some resemblance to a popular malware downloader known as Smoke Loader. Also known as Dofoil, the tool has been used to distribute malware payloads since at least 2011 or earlier, and is readily available on criminal forums. In 2018, Microsoft stymied a large cryptocurrency mining campaign that used Smoke Loader, and the security firm Proofpoint published findings in July about a data-stealing attack that disguised the downloader as a legitimate privacy tool to trick victims into installing it. Attackers can adapt the malware’s functionality with an assortment of ready-made plug-ins, and it’s known for using clever technical tricks to hide itself.

The BioBright researchers say that despite the similarities to Smoke Loader, Tardigrade appears to be more advanced and offers an expanded array of customization options. It also adds the functionality of a trojan, meaning that once installed on a victim network it searches for stored passwords, deploys a keylogger, starts exfiltrating data, and establishes a backdoor for attackers to choose their own adventure.

“This malware is designed to build itself differently in different environments, so the signature is constantly changing and it’s harder to detect,” says Callie Churchwell, a malware analyst at BioBright. “I tested it almost 100 times and every time it built itself in a different way and communicated differently. Additionally, if it’s not able to communicate with the command and control server, it has the capability to be more autonomous and self-sufficient, which was completely unexpected.”

This means that Tardigrade can still make decisions about how to proceed within a victim network even if it gets cut off from the hackers who deployed it. The researchers say that Tardigrade seems to be primarily designed for distribution through phishing attacks, but could also spread through tainted USB sticks, or even move from one infected network to another autonomously with the right interconnections. The researchers chose the name “tardigrade” in honor of the water bear micro-animals that can survive extreme heat, cold, irradiation, and even crash landing on the moon. The malware is similarly inconspicuous, adaptable, and resilient.

Nation state digital espionage against biotech and pharmaceutical companies has been increasingly common, says Charles Carmakal, senior vice president and chief technical officer of the cybersecurity firm Mandiant. Carmakal had not reviewed the Tardigrade research ahead of the disclosure, but says broadly that actors like China and Russia have worked consistently to grab intellectual property about enzymes, drugs, and manufacturing processes that could save those countries billions of dollars and years of research and development. The Covid-19 pandemic, he adds, created additional incentives for nation state attackers.

“Many of these incidents aren’t public, because if you have IP stolen, legally you don’t have to disclose it,” Carmakal says. “But we’ve seen financially motivated, disruptive attacks against health care companies and a variety of cyberattacks against biotech and pharma for espionage purposes.”

Carmakal adds that in some cases, these network infections have been traced to malicious USB drives.

BioBright’s Fracchia emphasizes that a lot remains unknown about Tardigrade's context and goals. It is unclear, for example, why attackers would use such a refined and sophisticated tool to deliver something as noisy and visible as ransomware—making it more likely that Tardigrade would be discovered. It's possible that the ransomware attack was a cover for other activity—a tactic that has been used before, including famously by Russia—but the researchers say they have no firm conclusions yet.

The stakes are high in biomanufacturing, Fracchia says, because many of the industrial networks used for production are built for openness and efficiency. Additional security and segmentation can complicate a highly choreographed manufacturing process. The BIO-ISAC prioritized coordinating public disclosure so potential victims can look for signs of infection and the broader security industry can be on alert. When the researchers first started investigating the malware, only a couple of virus scanners successfully detected it. Now a few dozen can flag it, and the researchers hope that even more will add protections.

“The basic design of many networks in the biomanufacturing field has inherent cybersecurity issues,” he says. “So with this disclosure we’re trying to not just say, ‘Hey, eat your vegetables.’ It’s come to the point where we’re basically saying the security equivalent of ‘Eat them or you’ll die.’”

If other industries are any indication, there’s no one warning that will motivate total systemic change overnight. But Tardigrade may act as an important wakeup call in a sector that is more critical than ever right now.