Threat Landscape for Industrial Automation Systems in H1 2017

**Executive summary:** Kaspersky Lab ICS CERT analyzes compromises by the Energetic Bear/Crouching Yeti APT that infected web and SSH servers across multiple countries (used as waterholes and auxiliary infrastructure), documented credential harvesting via SMB requests, deployment of web shells and a backdoored sshd, widespread scanning activity and numerous IOCs (file paths, php hashes, yara rule) along with detection/remediation scripts.