U.S. Agencies Warn of Iran-Linked PLC Attacks Disrupting Critical Infrastructure
Summary
U.S. agencies warn that Iran-linked actors are targeting internet-exposed PLCs across critical infrastructure, with reported disruptions involving PLC project files and manipulated HMI/SCADA displays. They urge organizations to assess OT networks and apply advisory m
Key points
- Federal agencies say Iran-linked actors have recently targeted internet-exposed PLCs, particularly Rockwell Automation/Allen-Bradley devices; other vendors may also be at risk.
- Agencies report that organizations in multiple U.S. critical infrastructure sectors experienced disruptions from malicious interactions with PLC project files and altered data displayed on HMI and SCADA systems.
- The sectors named include government services and facilities, water and wastewater, and energy.
- The agencies say the activity resembles earlier operations attributed to Iran-linked groups such as CyberAv3ngers; the article does not attribute the current activity directly to that group.
- Organizations are urged to review the advisory's tactics, techniques, and indicators for current or historical activity and apply its mitigations.
Article Details
- Event Type
- Federal agencies issued an urgent warning about Iran-linked cyberattacks targeting internet-exposed PLCs at U.S. critical infrastructure organizations.
- Impact
- Organizations across multiple U.S. critical infrastructure sectors experienced disruptions involving malicious interactions with PLC project files and manipulation of data displayed on HMI and SCADA systems. The advisory identified government services and facilities, water and wastewater systems, and energy sectors as targets; it noted particular targeting of Rockwell Automation/Allen-Bradley PLCs.
Threat Actors
CyberAv3ngersThe article describes CyberAv3ngers as linked to Iran’s Islamic Revolutionary Guard Corps and says the group previously targeted PLCs in U.S. infrastructure sectors, including water facilities. The current activity was described as similar to its earlier operations, not definitively attributed to the group.Emennet PasargadThe article identifies Emennet Pasargad as an Iranian hacking group and says the U.S. government announced rewards for information on its members.HandalaThe article says the U.S. government officially linked Handala to the Iranian government. It reports that the group targeted Stryker and hacked FBI Director Kash Patel’s personal email account; the reported device-wiping and email-release details are attributed to the article.
Vendors
OpenAIIn October 2024, artificial intelligence giant OpenAI said the CyberAv3ngers hackers used its popular ChatGPT tool to plan ICS attacks.Rockwell Automationinternet-exposed programmable logic controllers (PLCs), particularly those manufactured by Rockwell Automation/Allen-Bradley, though other vendors may also be at risk.
Products
Allen-Bradleyprogrammable logic controllers (PLCs), particularly those manufactured by Rockwell Automation/Allen-Bradley, though other vendors may also be at risk.ChatGPTIn October 2024, artificial intelligence giant OpenAI said the CyberAv3ngers hackers used its popular ChatGPT tool to plan ICS attacks.
Countries
IranSeveral critical infrastructure organizations in the US were disrupted by Iran-linked cyberattacks that impacted operational technology (OT) devices, according to an urgent warning from federal agencies on Tuesday.IrelandThe group has targeted industrial control systems (ICS) at a water utility in Ireland (the attack left people without water for two days), a water utility in Pennsylvania, and other water facilities in the United States.United StatesSeveral critical infrastructure organizations in the US were disrupted by Iran-linked cyberattacks that impacted operational technology (OT) devices, according to an urgent warning from federal agencies on Tuesday.
Industries
Energygovernment services and facilities (including local municipalities), water and wastewater systems, and energy sectors.GovernmentCommand warned that attacks in recent weeks have targeted devices spanning multiple sectors, including government services and facilities (including local municipalities), water and wastewater systems, and energyWater and wastewatermultiple sectors, including government services and facilities (including local municipalities), water and wastewater systems, and energy sectors.