U.S. Advisory Adds Siemens and Schneider PLCs to Iranian Hackers’ Target List
Summary
An updated U.S. advisory says Iran-linked actors have targeted PLCs from Rockwell, Schneider Electric and Siemens, using malicious project files and altered HMI/SCADA displays; it adds detection guidance and IOCs.
Key points
- The July 22 advisory update adds Schneider Electric and Siemens PLCs to the previously reported targeting of Rockwell Automation devices.
- The advisory describes FBI investigators finding that an attacker used configuration software to load a malicious project file onto a U.S. victim’s PLC; the file added logic that overrode safe operating parameters.
- Devices named in the advisory include Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 PLCs.
- The advisory says attackers used manufacturers’ programming software and leased third-party-hosted infrastructure, targeting ports 44818, 2222, 102, 502 and 22.
- According to the advisory, attackers extracted PLC project files, modified or deleted logic, manipulated HMI/SCADA displays, and disabled critical shutdown and alarm logic.
- The updated advisory adds detection guidance and indicators of compromise.
- Handala claimed it could have disrupted Cal Water’s water supply; the utility said it found no evidence of activity in its OT environment.
Article Details
- Event Type
- Updated US government cybersecurity advisory on Iran-linked targeting of industrial control systems and programmable logic controllers.
- Impact
- Attackers used malicious PLC project files and modified or deleted project logic, including changes that disabled critical shutdown and alarm functions and could allow unsafe conditions without alerting operators. PLC project files were also extracted and exfiltrated. The advisory reports targeting of Rockwell Automation, Schneider Electric, and Siemens PLCs; no specific operational impact from these attacks is confirmed in the article.
Threat Actors
CyberAv3ngersThe article identifies CyberAv3ngers as a group that carried out attacks on ICS/OT systems in prior years.HandalaThe article says Handala took the lead in ICS/OT targeting this year and describes its attack on Stryker. Handala also claimed it could have disrupted the water supply after hacking systems owned by California Water Service; the utility said it found no evidence of activity in its OT environment.
Vendors
Rockwell Automationhave been targeting industrial control systems (ICS) made by Siemens, Schneider Electric, and Rockwell Automation.Schneider Electricwarning that hackers have been targeting industrial control systems (ICS) made by Siemens, Schneider Electric, and Rockwell Automation.Siemensorganizations, warning that hackers have been targeting industrial control systems (ICS) made by Siemens, Schneider Electric, and Rockwell Automation.
Products
Allen-BradleyThe authoring agencies said at the time that threat groups had hacked internet-exposed programmable logic controllers (PLCs), naming Allen-Bradley devices made by Rockwell Automation.CompactLogixInvestigators are aware of attacks against Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 (BMX P34), and Siemens S7-1200 series PLCs.EcoStruxure Control ExpertThe vendor configuration software targeted by APTs includes Rockwell Automation Studio 5000 Logix Designer, Schneider Electric EcoStruxure Control Expert, and Siemens TIA Portal.Micro850Investigators are aware of attacks against Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 (BMX P34), and Siemens S7-1200 series PLCs.Modicon M340 (BMX P34)Investigators are aware of attacks against Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 (BMX P34), and Siemens S7-1200 series PLCs.S7-1200Investigators are aware of attacks against Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 (BMX P34), and Siemens S7-1200 series PLCs.Studio 5000 Logix DesignerThe vendor configuration software targeted by APTs includes Rockwell Automation Studio 5000 Logix Designer, Schneider Electric EcoStruxure Control Expert, and Siemens TIA Portal.TIA PortalThe vendor configuration software targeted by APTs includes Rockwell Automation Studio 5000 Logix Designer, Schneider Electric EcoStruxure Control Expert, and Siemens TIA Portal.
Countries
IranThe US government has updated a recent cybersecurity advisory describing Iran-linked attacks on critical infrastructure organizations, warning that hackers have been targeting industrial control systems (ICS) made byUnited StatesThe US government has updated a recent cybersecurity advisory describing Iran-linked attacks on critical infrastructure organizations, warning that hackers have been targeting industrial control systems (ICS) made by
Industries
Energytargeting operational technology (OT) devices at organizations in the government services and facilities, energy, and water and wastewater sectors.Government Services and Facilitiesdisruptive attacks targeting operational technology (OT) devices at organizations in the government services and facilities, energy, and water and wastewater sectors.medical technologyA group named Handala has taken the lead this year, starting with a highly disruptive attack on the US medical technology giant Stryker.Water and wastewatertechnology (OT) devices at organizations in the government services and facilities, energy, and water and wastewater sectors.