The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has broadened its alert regarding Iranian-affiliated hacking groups targeting critical infrastructure, including facilities in the water and energy sectors. Initially, the advisory concentrated on programmable logic controllers (PLCs) produced by Rockwell Automation/Allen-Bradley. However, the updated warning indicates that these activities may now also involve devices from Schneider Electric, Siemens, and potentially other PLC brands.
This expansion of the alert comes as the conflict between the U.S. and Iran enters its fourth month, with authorities observing Iranian-affiliated advanced persistent threat (APT) groups attempting to disrupt PLCs since March. PLCs are essential components used for controlling and monitoring industrial processes.
The observed activity bears resemblance to previous attacks on PLCs attributed to CyberAv3ngers, also known as the Shahid Kaveh Group. This group is reportedly affiliated with the Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC) in Iran.
The primary focus of these attacks is on internet-facing PLCs, with CISA noting that attackers are targeting devices through open ports. The targeting of ports associated with protocols used by other operational technology (OT) vendors suggests an opportunistic approach, extending beyond Rockwell Automation/Allen-Bradley to include devices from companies like Schneider Electric and Siemens.
In one documented instance, the attackers leveraged Dropbear Secure Shell (SSH) software on victim modems to establish remote access via port 22. Once access was gained, the attackers proceeded to extract device project files and either modify or delete their logic.
CISA further reported that these modifications included disabling critical shutdown and alarm logic. This allowed systems to enter unsafe conditions without notifying operators of the anomalies, posing significant risks to operational safety and integrity.
The broadened scope of the advisory underscores the critical need for organizations to be vigilant about their internet-accessible devices. Beyond earlier recommendations to disconnect PLCs from the public internet, authorities now suggest implementing isolated architectures and strictly controlling network access to PLC devices.
Additionally, organizations are advised to regularly inspect project files running on PLCs for any unauthorized changes. It is also crucial to ensure that service providers are aware of the threats targeting PLCs and that all default passwords are changed to stronger, unique credentials.
