Iran-Linked Hackers Target US Industrial Systems
Cyberattacks on water and energy facilities are expanding in scope.
1Expanding Scope of Attacks
The US Cybersecurity and Infrastructure Security Agency (CISA) updated its alert on Iran-linked hackers targeting water and energy facilities. The attacks now target PLC devices from Schneider Electric and Siemens, in addition to Rockwell Automation/Allen-Bradley.
2Why PLC Devices Matter
PLCs (Programmable Logic Controllers) are used to control and monitor industrial processes. Compromising these devices can lead to severe disruptions and security vulnerabilities in critical infrastructure.
3Modus Operandi of the Attacks
Hackers target internet-facing PLC devices through open ports. They use Dropbear SSH software to gain remote access and modify or delete device project files.
4Dangerous Modifications
Attackers disable critical shutdown and alarm logic on PLC devices. This allows systems to enter unsafe conditions without notifying operators.
5Recommendations and Mitigations
CISA recommends disconnecting PLC devices from the internet, implementing isolated architectures, and controlling network access. It also advises checking project files for unauthorized changes and changing default passwords.
6Protecting Critical Infrastructure
These attacks underscore the importance of cybersecurity for critical infrastructure. Organizations need to take proactive measures against such threats.