FBI and CISA Urge Critical Infrastructure Operators to Secure Third-Party ICS Access
Summary
An FBI and CISA fact sheet advises critical infrastructure operators on assessing and reducing risks from third-party ICS integrators, citing a 2025 intrusion at an industrial automation company where actors prepared about 800 files for presumed exfiltration.
Key points
- FBI and CISA advise operators to limit integrators’ access to only what is necessary and assess the risks of granting access to industrial systems.
- The fact sheet describes a March–April 2025 intrusion at a U.S. industrial automation company. Actors searched for terms including “customers” and “SCADA” and created nine ZIP files containing about 800 files for presumed exfiltration.
- The files reportedly included customer SCADA information, ICS device details, and schematics; the fact sheet says this information could enable later disruption of operational environments.
- Assess what data integrators can access, where it is stored, whether they have remote ICS access, and whether operations can continue if an integrator is compromised.
- Include cybersecurity and supply-chain requirements in contracts, covering data protection, remote access, patch and change management, deployed components, authorized personnel, and local support.
- Inventory integrator-provided hardware and software, minimize public internet exposure, and monitor remote access—using on-demand access where possible.
- Maintain secure offline backups and practice manual operations and recovery procedures that account for third-party dependencies.
Article Details
- Defense Focus
- Reduce the risk of compromise to critical infrastructure operational environments through third-party ICS integrator access, supply chains, remote connections, and data handling.
- Detection Methods
- Monitor and log integrator remote access, using routes operators can observe.
- Review remote-access activity and authorization; use on-demand access where possible.
- Data Sources
- Logs of integrator remote access
- Inventory of integrator-supplied hardware and software
- Documentation of how supplied components connect to infrastructure and are updated
- ICS network designs, device specifications, and other ICS data held or accessed by integrators
- Defensive Actions
- Apply least privilege to users, processes, and systems in OT environments.
- Assess integrator-related risks, including contract access, data autonomy, process controls, supply-chain security, device and network security, data storage location, and geopolitical considerations.
- Include cybersecurity and supply-chain requirements in contracts, covering data protection, remote access, cybersecurity programs, change and patch management, component hardening, authorized personnel, and local engineering support.
- Identify externally exposed devices and minimize exposure by disconnecting devices from the public-facing internet.
- Maintain secure offline backups of software needed to operate equipment and prepare for recovery and independent operation if an integrator is compromised.
- Practice manual operations and account for third parties in operational and recovery procedures.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe article says the files were created for presumed exfiltration, but does not describe the exfiltration method.T1083 · File and Directory DiscoveryAccording to FBI technical analysis, actors on the industrial automation company's network searched for terms including “customers” and “SCADA.”T1560.001 · Archive via UtilityAccording to FBI technical analysis, actors created nine .zip files containing approximately 800 files for presumed exfiltration.
Countries
Industries
Critical infrastructureconsiderations for critical infrastructure entities to reduce risk and minimize vulnerabilities when workingIndustrial automationaccess to the network of a U.S. industrial automation solutions company that offered services—such asPower utilitiespower utilities and transportation entities. While on the network, threat actors searched terms, includingTransportationpower utilities and transportation entities. While on the network, threat actors searched terms, including