FBI and CISA Urge Critical Infrastructure Operators to Secure Third-Party ICS Access

Summary

FBI and CISA guidance recommends least privilege, secure contracts, monitored remote access and recovery planning for third-party ICS integrators, citing a 2025 intrusion in which actors staged customer-related files for presumed exfiltration.

Key points

FBI and CISA advise critical infrastructure operators to limit integrator access to what is necessary for assigned tasks.
The agencies identify supply-chain, data-storage and remote-access risks associated with third-party ICS integrators.
FBI analysis says foreign cyber actors accessed a U.S. industrial automation company’s network between March and April 2025.
The actors searched for terms including “customers” and “SCADA” and created nine ZIP archives containing about 800 files for presumed exfiltration.
The files reportedly included customer SCADA information, ICS device details and schematics that could inform later disruptive attacks.
Recommendations include cybersecurity requirements in contracts, monitoring integrator remote access, and inventorying supplied hardware and software.
Operators are advised to maintain offline backups and practice manual operation and recovery procedures.

Article Details

Defense Focus: Reduce risks from third-party ICS integrators, especially excessive access, insecure supply-chain practices, and remote access to operational environments.
Detection Methods: Monitor and log integrator remote access, using access routes operators can observe.
Use on-demand remote access so operators proactively approve connections.
Assess integrator access, data handling, supplied components, and external internet exposure.
Data Sources: Logs of third-party integrator remote access
Inventories of integrator-supplied hardware and software, with connection and update documentation
ICS network designs, device specifications, and operational data
Defensive Actions: Apply least privilege to integrator access in OT environments.
Include cybersecurity and supply-chain security requirements in contracts, covering data storage, remote access, personnel authorization, change and patch management, and protection of ICS data.
Evaluate externally exposed devices and disconnect them from the public-facing internet where possible.
Maintain secure offline backups and capabilities for manual operation and recovery without the integrator.
Conduct risk assessments of integrator contracts, equipment, networks, data access, and storage locations.
Report suspicious cyber activity to CISA or the FBI.

MITRE ATT&CK

T1083 · File and Directory DiscoveryAccording to FBI technical analysis, actors searched the compromised company's network for terms including “customers” and “SCADA.”T1560.001 · Archive via UtilityAccording to FBI technical analysis, actors created nine ZIP archives containing approximately 800 files for presumed exfiltration.

Countries

United StatesFurthermore, third-party integrators that operate and host data outside of the United States may pose additional risks, as they may be subject to different data storage and management laws that do not meet the security

Industries

Critical infrastructureFBI and CISA issued guidance for critical infrastructure owners and operators on reducing risk when using third-party ICS integrators, with emphasis on least privilege, secure contracts, and monitoring remote access.Industrial automationindustrial automation company, searched for SCADA-related terms, and staged data for possible exfiltration from customer environments.Power utilitiesindustrial automation solutions company, power utilities, transportation entities Transportationindustrial automation solutions company, power utilities, transportation entities