Experts React to U.S. Warning on Iran-Linked Attacks Targeting Industrial Control Systems
Summary
A U.S. interagency advisory warned that Iran-linked actors targeted internet-exposed PLCs and other operational technology. Industry experts discussed reported impacts, cautioned that many related claims remain unverified, and recommended isolation, segmentation, and OT
Key points
- A U.S. interagency advisory warned that Iran-linked actors targeted internet-exposed programmable logic controllers (PLCs), including Rockwell Automation devices, and said other vendors may also be at risk.
- The article says the advisory linked tampering with HMIs and SCADA systems to operational disruption and financial loss; it describes use of Rockwell Studio 5000 Logix Designer.
- A Nozomi Networks executive said threat groups had made hundreds of unverified claims of OT compromises since the conflict began, with no public disclosures from affected organizations.
- Experts recommended removing PLCs from direct internet access, segmenting OT and IT networks, monitoring control-system traffic, and tightly controlling remote access and engineering workstations.
- A Suzu Labs executive noted that the advisory's listed protocols include Rockwell-associated EtherNet/IP, Siemens S7comm, and Modbus, and argued the risk is not limited to Rockwell devices.
- Some industry commenters cautioned that patching may be difficult in operational environments and emphasized access controls and resilience; these are expert views, not findings independently established by the article.
Article Details
- Event Type
- Iran-linked hackers reportedly targeted internet-exposed programmable logic controllers and other operational technology in critical infrastructure, manipulating HMI and SCADA systems.
- Impact
- The article reports operational disruption and financial loss from tampering with control systems. Manipulated displays and control logic may also create risks to equipment and physical safety.
People
Damon SmallMember of the Board of Directors at Xcape; analyzed the reported targeting of US water and energy utilities and recommended measures to protect PLCs.David SequinoCo-Founder and CEO of OmniTrust; discussed the risks of manipulating project files and HMIs in critical infrastructure.Denis CalderoneCTO of Suzu Labs; discussed reported use of Studio 5000 Logix Designer to interact with PLCs and manipulate HMI and SCADA data.Duncan GreatwoodCEO of Xage Security; commented on reported exploitation of water and energy systems and recommended resilience and access-control measures.Markus MuellerField CISO at Nozomi Networks; commented on reported targeting of exposed OT devices, unverified compromise claims, and the CyberAv3ngers’ earlier operations.Ross CoffmanPresident of Forward Edge-AI and retired US Army lieutenant general; commented on reported Iranian cyber activity against American utilities.Ross FilipekCISO of Corsica Technologies; analyzed potential cascading effects of infrastructure disruptions and recommended OT segmentation and monitoring.Steve PovolnyVice President of AI Strategy and Security Research at Exabeam; discussed ICS exposure and defensive measures amid heightened tensions.Süleyman ÖzarslanCo-Founder of Picus Security; commented on attackers’ reported use of trusted OT engineering workflows and the risks of exposed PLCs.
Threat Actors
Vendors
Rockwell AutomationAccording to an advisory written by CISA, the FBI, and several other agencies, hackers have targeted programmable logic controllers (PLCs) made by Rockwell Automation, but devices from other vendors are also at risk.Schneider ElectricIf you’re running Siemens, Schneider, or any other PLC platform and assuming this doesn’t apply to you, look at the port list again: 44818 for EtherNet/IP (Rockwell and others), 102 for S7comm (Siemens), 502 for ModbusSiemensBoth Rockwell and Siemens have published advisories to alert customers.UnitronicsThe most high-profile of these campaigns was the 2023-24 operations carried out by CyberAv3ngers targeting Unitronics devices.
Products
Allen-BradleyNow, the advisory specifically calls out Rockwell Automation and Allen-Bradley, and that makes sense because Rockwell holds roughly 35 to 40 percent of the US PLC market.CompactLogix5000 Logix Designer, which is Rockwell Automation’s own PLC programming software, to interact with CompactLogix and Micro850 controllers at the file object level.Micro850Designer, which is Rockwell Automation’s own PLC programming software, to interact with CompactLogix and Micro850 controllers at the file object level.Studio 5000 Logix DesignerThe threat actors targeted internet-exposed PLCs and abused legitimate programming software such as Rockwell’s Studio 5000 Logix Designer to achieve their goals.
Countries
IranThe US government warned this week that Iran-linked hackers have targeted critical infrastructure organizations, hacking industrial control systems (ICS) and other operational technology (OT).United StatesThe US government warned this week that Iran-linked hackers have targeted critical infrastructure organizations, hacking industrial control systems (ICS) and other operational technology (OT).