CISA: In July, Hackers Attacked More Than 100 U.S. Water Systems

The American cybersecurity agency CISA has reported that it recorded cyberattacks on more than 100 internet-facing systems in the U.S. water and wastewater sector. This clarifies the scale of an ongoing campaign against water utilities in Michigan, Minnesota and at least five other states.

The target — industrial controllers

According to the agency, the attacks are aimed primarily at programmable logic controllers (PLCs) — the devices that manage physical equipment at water facilities, in the energy sector and in other critical infrastructure industries. In recent weeks the attackers have hit controllers from various manufacturers: Rockwell, Schneider Electric and, most recently, Siemens. CISA had earlier noted that some of the attacks rely on artificial intelligence tools that, based on public data, generate scripts to exploit vulnerable Siemens controllers.

The intrusions had almost no impact on water supply to the public, but they did cause failures and disruptions while specialists investigate the incidents. According to earlier CISA data, in a number of cases the hackers were able to change controller settings, disabling emergency-shutdown procedures and alarms — something that can create “unsafe conditions” without notifying operators.

Who is at risk and who is behind it

Many of the affected communities are located in rural or isolated areas, where an infrastructure failure has ramifications across a large territory. According to reports citing senior U.S. officials, U.S. intelligence believes that Iran is likely behind the largely opportunistic attacks — presumably in response to the war against Iran waged by the United States and Israel. That said, officials have not yet reached a definitive attribution.

What happened has once again sharpened questions about the resilience of U.S. critical infrastructure as a whole. In recent years, American authorities have warned that hackers working for China are planting destructive malware in infrastructure systems, ready to be triggered as a diversion in the event of a possible invasion of Taiwan. Russia has also been linked to a number of attacks on water supply and power grids in Europe — activity viewed as part of a campaign to “probe” the NATO alliance.

Source: TechCrunch