cyber.hendryadrian.com
Security News · therecord.media

U.S. Agencies Warn of Iran-Linked Attacks on Internet-Facing OT

· Original article ↗

Summary

U.S. agencies report Iran-affiliated actors targeting internet-facing PLCs, with disruptions and financial losses across critical infrastructure. The advisory highlights CVE-2021-22681 and urges organizations to remove OT from direct internet exposure and check logs.

Key points

  • Agencies say Iran-affiliated actors have targeted internet-connected Rockwell/Allen-Bradley PLCs; Siemens equipment may also be affected.
  • The advisory reports disruptions involving PLC project files and manipulated data on HMI and SCADA displays, as well as financial losses.
  • Reportedly affected sectors include municipal governments, water and wastewater systems, and energy.
  • The FBI advisory highlights CVE-2021-22681 in Rockwell OT products; CISA said it was being exploited and ordered federal agencies to patch affected products by March 26.
  • Agencies recommend removing PLCs and other OT from direct internet exposure, checking logs for suspicious traffic, and applying vendor patches.
  • Officials compared the activity with 2023–2024 Iran-linked PLC intrusions and said at least 75 devices were compromised in the earlier campaign.

Article Details

Event Type
Iran-affiliated cyber activity targeting internet-facing operational technology, including PLCs, with exploitation of CVE-2021-22681 reported.
Impact
U.S. organizations in municipal government, water and wastewater, and energy have experienced operational disruptions and financial losses. Agencies reported malicious interactions with project files and manipulation of data shown on HMI and SCADA displays. Separately, officials disclosed that at least 75 devices were compromised during the related 2023 campaign.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThe advisory reports exploitation of CVE-2021-22681 against internet-facing Rockwell operational technology products.

CVE

CVE-2021-22681Rockwellautomation · Factorytalk services platform; Rockwellautomation · Rslogix 5000; +1 moreagencies link the activity to IRGC-associated APTs that have exploited CVE-2021-22681 and urge removing OT devices from direct internet exposure and checking logs for suspicious traffic.

People

Rob LeeThe Dragos CEO told reporters that the group behind the 2023 attacks continued to focus on energy utilities, oil and gas, railways, and the water sector, and described its growing understanding of control loops and physical processes.

Threat Actors

Islamic Revolutionary Guard Corps (IRGC)The article says hackers linked to the IRGC targeted PLCs in the 2023 campaign and describes current activity as Iran-affiliated. The attribution is presented as a link, not as confirmed responsibility by the IRGC itself.

Vendors

Rockwell AutomationIranian-affiliated threat actors are specifically targeting internet-connected OT devices including Rockwell Automation or Allen-Bradley-manufactured programmable logic controllers (PLC).Siemensinternet-facing operational technology devices—particularly Rockwell/Allen-Bradley PLCs and potentially Siemens equipment—causing operational disruptions and financial losses across multiple U.S.UnitronicsThe agencies compared the activity to an Iranian campaign in 2023 and 2024 where hackers linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) targeted PLCs made by Israeli company Unitronics.

Products

Allen-Bradley PLCshackers have been attacking internet-facing operational technology devices—particularly Rockwell/Allen-Bradley PLCs and potentially Siemens equipment—causing operational disruptions and financial losses across

Countries

IranIran-affiliated hackers have been attacking internet-facing operational technology devices—particularly Rockwell/Allen-Bradley PLCs and potentially Siemens equipment—causing operational disruptions and financial lossesUnited Statesand potentially Siemens equipment—causing operational disruptions and financial losses across multiple U.S.

Industries

EnergyAttacks have caused operational disruption and financial loss across municipal governments, water/wastewater systems, and the energy sector.GovernmentHackers affiliated with the government of Iran are attacking internet-facing operational technology (OT) devices and causing disruptions across multiple U.S.Water and wastewaterThe advisory said Iranian actors are targeting local municipal governments, water and wastewater systems and the energy sector.

Related Articles