The US government has warned that Iranian state-backed hackers are actively infiltrating and disrupting the industrial control systems of US water and energy supply companies. The new warning comes months after federal agencies warned of escalating hacking efforts by Iranian actors amid the ongoing war.
In an advisory updated Wednesday, the FBI, NSA, Department of Energy and CISA said Iranian hackers are targeting programmable logic controllers on operational networks connected to the internet, allowing them to manipulate data on the displays and causing outages and disruption.
Iranian hackers were initially found to be targeting Rockwell controllers earlier this year, but the latest advisory expands the types of industrial control systems targeted to include products from Schneider Electric and Siemens.
The agency warned that “all internet-exposed” industrial control systems could be affected and urged critical infrastructure owners to take action. According to the advisory, the Iranian-backed hackers “conducted this activity to cause destructive effects within the United States,” likely in response to the ongoing war between Iran, the United States, and Israel.
According to the FBI, hackers infiltrated one critical infrastructure provider and altered the controller's programming logic to disable processes that handle critical shutdowns and alarms. Federal authorities said this allowed “the system to enter an unsafe state without notifying the operator of the abnormality.”
This is the latest in a series of cyberattacks carried out by Iranian government hackers and their proxies across the region since the war began in February.
The hacks range from the country's typical espionage and hack-and-leak operations, such as leaking the contents of FBI Director Kash Patel's personal email account, to more atypical and destructive hacks that have caused extensive damage and disruption. Among the more notable incidents was the hacking of US medical technology giant Stryker, which allowed Iranian hacker group Handara to remotely wipe tens of thousands of employee devices.
Handara also took credit for a data breach that affected California water utility Cal Water in June, claiming (without providing evidence) that it may have disrupted water supplies. The water utility said it had seen no evidence of unauthorized access to its operational network, which manages water supplies.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.