US Warns of Iranian Attacks on Rockwell, Siemens PLCs

#cybersecurity #industrialcontrolsystems #cyberattack #threatactor

Originally published on CyberNetSec.

Executive Summary

U.S. federal agencies, including CISA, the FBI, the NSA, and the EPA, have issued an updated joint advisory regarding a persistent cyber campaign by Iranian-affiliated actors against U.S. critical infrastructure. The threat actors are targeting internet-exposed Operational Technology (OT) devices, specifically Programmable Logic Controllers (PLCs), to gain access and cause disruptive effects. The campaign has expanded from targeting Rockwell Automation PLCs to also include devices from Schneider Electric and Siemens. The primary targets are in the Water and Wastewater Systems (WWS) and Energy sectors. The attackers' goal appears to be establishing persistent access to be in a position to cause disruption in response to geopolitical events.

Threat Overview

The campaign, attributed to actors affiliated with Iran, focuses on exploiting a fundamental weakness in many OT environments: the direct exposure of sensitive control systems to the public internet. The actors are not necessarily using zero-day vulnerabilities but are instead targeting PLCs with default credentials, weak configurations, or unpatched firmware.

The updated advisory provides new indicators of compromise (IOCs) and highlights the expansion of targeted devices. The attackers' TTPs include:

Scanning the internet for exposed OT devices.
Attempting to log in with default or easily guessable credentials.
Manipulating Human Machine Interface (HMI) displays to show false information or warnings.
Attempting to download malicious project files or logic to the PLCs, which can alter physical processes and cause operational disruptions.

Experts note that the primary objective may not be immediate destruction but rather to establish a foothold (T1078 - Valid Accounts) for future operations, allowing them to act at a time of their choosing.

MITRE ATT&CK for ICS Techniques

T0886 - Remote Services: Accessing internet-exposed PLCs.
T0813 - Default Credentials: Gaining initial access using default manufacturer passwords.
T0855 - Man-in-the-Middle: Potentially intercepting communications to manipulate data.
T0831 - Manipulation of Control: Modifying PLC logic to disrupt physical processes.
T0829 - Manipulation of View: Altering HMI displays to mislead operators.
T0845 - Program Download: Downloading malicious project files to the PLC.

Impact Assessment

The potential impact of this campaign is severe. Successful attacks on WWS or energy sector PLCs could lead to:

Disruption of Essential Services: Manipulation of water treatment processes or electrical grid components could lead to service outages for large populations.
Physical Damage: Incorrectly controlled industrial processes can cause physical damage to equipment, leading to costly repairs and extended downtime.
Public Safety Risks: In the WWS sector, manipulating treatment processes could pose a direct threat to public health.
Economic Loss: Disruption to energy or manufacturing facilities can result in significant financial losses. The campaign represents a direct threat to U.S. national security and the safety of its citizens by targeting the foundational services of critical infrastructure.

IOCs — Directly from Articles

No specific technical indicators of compromise (e.g., IP addresses, domains, hashes) were provided in the source articles. The official CISA advisory should be consulted for detailed IOCs.

Cyber Observables — Hunting Hints

Security teams in OT environments should hunt for the following:

Network Traffic: Any inbound connection attempts to PLCs or HMIs from the public internet. Monitor for traffic on common ICS ports like 502 (Modbus), 44818 (EtherNet/IP), or 20000 (DNP3) from untrusted sources.
Device Logs: PLC and HMI logs showing logins from unknown IP addresses or at unusual times.
Configuration Changes: Unexpected changes to PLC logic, setpoints, or project files. Use checksums or file integrity monitoring on project files.
HMI Activity: Discrepancies between HMI readings and physical process values.

Detection & Response

Asset Inventory: Maintain a complete and accurate inventory of all OT assets, including their network exposure. Tools like Shodan can be used defensively to identify your organization's exposed devices.
Network Monitoring for OT: Deploy OT-aware network security monitoring solutions that can parse industrial protocols and detect anomalous commands or configurations. This is an application of D3-NTA: Network Traffic Analysis tailored for ICS.
Baseline Analysis: Establish a baseline of normal OT network traffic and device behavior. Alert on any deviations, such as a new device connecting to the network or a PLC being accessed from a new endpoint.

Mitigation

Remove Internet Exposure: The most critical mitigation is to ensure that no PLCs, HMIs, or other OT devices are directly accessible from the internet. Use VPNs with strong authentication for any required remote access (M1035 - Limit Access to Resource Over Network).
Network Segmentation: Implement robust network segmentation between IT and OT networks. Use a DMZ to broker any required communication, and strictly limit the protocols and hosts that can communicate between the zones (M1030 - Network Segmentation).
Change Default Credentials: Immediately change all default passwords on PLCs, HMIs, and other network devices. Enforce a strong password policy (M1027 - Password Policies).
Firmware Updates: Maintain a program to regularly update firmware on OT devices to patch known vulnerabilities (M1051 - Update Software).