US agencies warn Iranian hackers targeting critical PLCs

U.S. federal agencies are warning that Iranian state-backed hackers are actively breaking into and disrupting industrial control systems at American water, energy, and government facilities, manipulating equipment to create unsafe conditions without alerting operators. The campaign, which has been underway since at least March, targets internet-exposed programmable logic controllers (PLCs) from major manufacturers including Rockwell Automation, Schneider Electric, and Siemens.

In a joint advisory updated on July 22, the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the National Security Agency, and the Department of Energy detailed the ongoing activity. The agencies stated the hackers are using legitimate vendor configuration software hosted on leased, third-party infrastructure to connect to vulnerable PLCs. Once inside, they download project files, modify their control logic, and manipulate data displayed on human-machine interface and supervisory control and data acquisition (SCADA) screens.

The consequences are operational disruption and financial loss. In one confirmed incident at a U.S. critical infrastructure organization, investigators found a...