Iran-Linked Hackers Are Targeting U.S. Water and Power Industrial Systems

The U.S. government has issued an updated warning that hackers tied to the Iranian state are actively breaking into industrial control systems at water and power facilities and disrupting their operation. The joint document was prepared by the FBI, the National Security Agency, the Department of Energy and CISA.

What exactly is being targeted

According to the agencies, the attackers have set their sights on programmable logic controllers (PLCs) connected to internet-facing operational networks. Once they gain access, the attackers can distort the data shown on operators' displays, causing shutdowns and disruptions. Attacks were initially recorded early in the year against controllers made by Rockwell, but the list has now grown: devices from Schneider Electric and Siemens have also come under fire. The agencies warn that “potentially all” industrial control systems reachable from the internet could be vulnerable, and they urge owners of critical infrastructure to take action.

One case described by the FBI is especially alarming: at one facility, hackers altered the operating logic of the controllers, disabling the processes responsible for emergency shutdown and alarms. As a result, systems could enter a dangerous state without notifying operators of the malfunction.

Part of a broader campaign

The warning is the latest in a string of cyberattacks that Iranian government hackers and their proxies have launched in the region since the war began in February. The activity ranges from routine espionage and “hack-and-leak” operations — for example, the leak of the contents of FBI Director Kash Patel's personal email — to atypical destructive attacks causing large-scale damage.

Among the most notable incidents was an attack on the American medical-device maker Stryker: the group Handala managed to remotely wipe data from tens of thousands of employees' devices. The same group claimed responsibility for the June data breach at the California water provider Cal Water and said it could have disrupted the water supply — though it offered no proof. The provider itself said it had found no signs of unauthorized access to the operational networks that control water delivery.

The agencies link the surge in activity to the ongoing conflict between Iran, on one side, and the United States and Israel, on the other, noting that the goal of the attacks is to cause “destructive consequences” on U.S. soil.

Source: TechCrunch