Iranian cyber adversaries are actively targeting internet-exposed industrial systems across brands like Rockwell Automation, Allen-Bradley, Schneider Electric and Siemens.

In an advisory update published on July 22, the US Cybersecurity and Infrastructure Security Agency (CISA) said the FBI had observed Iran-affiliated cyber threat actors download a malicious project file to a targeted programmable logic controller (PLC) at a US-based critical infrastructure organization using configuration software.

The Bureau also saw the manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.

Further analysis indicated the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters in the victim’s environment.

Iranian Cyber Campaign Targets US Critical Infrastructure

This follows an April advisory warning of an ongoing cyber campaign from Iranian actors against US critical infrastructure.

According to CISA, these actions disrupted PLCs across several US critical infrastructure sectors, notably government services and facilities, water and wastewater systems and energy.

In the initial warning, the agency named PLCs from Rockwell Automation and Allen-Bradley (a subsidiary of Rockwell Automation) as being targeted by these actors, following malicious changes detected in reusable code modules exploited within Rockwell Automation PLC programs.

The July update confirmed that the same advanced persistent threat (APT) actors are also targeting PLCs manufactured by Schneider Electric and Siemens.

This new assessment comes from findings that the APT actors have been using configuration software, like Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert and Siemens’ Totally Integrated Automation (TIA) Portal on leased, third-party hosted infrastructure to exfiltrate device project files from PLC devices to threat-actor-controlled infrastructure.

CISA named some of the specific models being targeted – Allen Bradley’s CompactLogix and Micro850 PLCs, Schneider Electric’s BMX P34 and Modicon M340 models and Siemens’ S7-1200 series PLCs.

The agency also said PLCs of other brands could also “potentially” be targeted.

While the advisory did not refer to any specific threat group, CISA noted that the ongoing campaign bears similarities with a November 2023 operation that involved a group affiliated to Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC CEC). The group in question is commonly known as ‘CyberAv3ngers’ and tracked by cybersecurity companies under many names including Bauxite, Hydro Kitten, the Shahid Kaveh Group, Soldiers of Solomon, Storm-0784 and UNC5691.

Iranian Hackers Target Flaws Affecting Multiple OT Environments

According to Nick Tausek, lead security automation architect at Swimlane, the latest update moves the Iran-linked threat "beyond broad concern and into specific, actionable detail."

Security teams now have new indicators, targeted ports, affected device families and examples of attackers changing PLC logic or disabling critical safeguards. 

Pete Luban, field CISO at AttackIQ, also highlighted that it shows that Iranian cyber activity is becoming less dependent on one product and more focused on weaknesses that repeat across operational environments.

"By targeting controllers from several manufacturers, attackers can reuse the same playbook wherever exposed devices and weak access controls exist," Luban said.

"The problem is getting that intelligence into active workflows before the attackers move again," Tausek added.

"That's hard to do when asset data, network alerts, threat intelligence, and incident procedures live in separate systems. Security teams may understand the threat, but still lose valuable time gathering context and determining which exposed devices require immediate attention," he said.

How US CNI Organizations Can Mitigate the Threat

The advisory urged US CNI providers to:

• Install PLCs consistent with manufacturers' guidelines and security best practices
• Remove PLCs from direct internet exposure via secure gateway and firewall
• Query available logs for the provided indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including 44818, 2222, 102 and 502
• For Rockwell Automation devices, place the physical mode switch on the controller into run position

According to Ross Filipek, CISO at Corsica Technologies, the biggest issue faced by affected organizations is that most of them can't pause operations while an incident is investigated.

"Water utilities have to keep providing clean water. Energy providers have to maintain power and fuel availability. Local governments still need to support emergency services and public operations. Even a short disruption can force employees into slower manual processes, delay essential services and create public safety concerns," he said.

"Trusted backups of PLC logic are critical, as are tested recovery procedures and experienced responders who can contain an intrusion quickly. A single exposed controller may look like a local weakness. In critical infrastructure, it can become part of a much larger national security problem," Filipek added.

This article was updated on July 24 to add comments from cybersecurity experts.

Image credits: miamariapia / Dwi Doyo / Shutterstock.com