Threat Actors Launch Active Attacks on Semiconductor Firms Using Zero-Day Exploits

Semiconductor companies, pivotal in the tech industry for their role in producing components integral to everything from consumer electronics to critical defense systems, are under siege from sophisticated cyber threats.

These firms design, manufacture, and sell semiconductors, crucial elements with conductivity between that of a conductor and an insulator, and are prime targets for cybercriminals due to their strategic importance.

Darknet Markets and Zero-Day Exploits

Recent reports indicate that these companies are increasingly becoming targets on the darknet, where zero-day vulnerabilities are traded like currency among cybercriminals.

Zero-day vulnerabilities, which are flaws known to attackers but not yet to the software’s creator, represent a lucrative market.

According to DarkOwl, these vulnerabilities, especially those in Industrial Control Systems (ICS/SCADA), firmware, or chip toolchains, can be sold for vast sums, particularly when they compromise critical infrastructure.

For instance, vulnerabilities in ASML lithography systems, critical for semiconductor manufacturing, and in ARM-based architectures have been exploited in targeted attacks.

Ransomware and Supply Chain Attacks

The semiconductor sector has not been immune to ransomware. Groups like LockBit, BlackCat (ALPHV), and RansomEXX have engaged in highly calculated attacks, encrypting systems or stealing sensitive design data with threats to leak them unless hefty ransoms are paid.

A notable incident involved a TSMC supplier attacked by LockBit, with a ransom demand reaching $70 million.

Moreover, attackers are infiltrating supply chains at a hardware level.

There have been instances where malicious firmware was embedded into chips before deployment, posing risks not only to the semiconductor manufacturers but also to downstream users relying on these components.

As these attacks escalate, semiconductor companies are bolstering their defenses.

The acquisition of zero-day exploits and the monitoring of darknet forums for any mention of company assets or stolen credentials has become essential.

Real-world cases illustrate the severity:

• NVIDIA Breach (2022): The Lapsus$ group stole proprietary GPU designs and employee credentials, leading to unauthorized code-signing certificates and potential malicious driver development.
• Intel & AMD Firmware Leaks: Hackers have leaked engineering documentation and firmware signing keys on underground forums, which were later exploited for BIOS-level attacks.

Semiconductor firms are now adopting a multi-layered security approach.

This includes monitoring darknet spaces like RAMP, Genesis Market, and BreachForums, where initial access brokers sell compromised credentials that offer cybercriminals an entry point into corporate networks.

In conclusion, the semiconductor industry’s proactive stance in cybersecurity is crucial as it continues to drive technological advancements, facing an ever-evolving landscape of cyber threats.

Understanding and preempting operations on the darknet aids in safeguarding intellectual property and maintaining business continuity amidst these sophisticated cyber assaults.

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!