Key Takeaways
- CISA has broadened its alert to warn that Iranian‑affiliated APT groups are targeting internet‑facing programmable logic controllers (PLCs) from multiple vendors, not just Rockwell Automation/Allen‑Bradley.
- The threat actors exploit open ports (e.g., SSH on port 22) to gain remote access, extract or alter PLC project files, and disable safety‑shutdown and alarm logic.
- Compromised PLCs can drive critical infrastructure—such as water treatment and energy facilities—into unsafe operating states without alerting operators.
- Mitigation strategies include isolating PLCs from the public internet, implementing network segmentation, changing default credentials, monitoring project files for unauthorized changes, and ensuring service providers are aware of the threat.
- Continuous vigilance, regular audits, and adherence to CISA’s guidance are essential to prevent disruption and protect public safety.
Background of the CISA Alert
The Cybersecurity and Infrastructure Security Agency (CISA) first issued an advisory in March highlighting a campaign by Iranian‑linked advanced persistent threat (APT) groups that specifically targeted programmable logic controllers (PLCs) made by Rockwell Automation/Allen‑Bradley. These PLCs are the workhorses of industrial control systems, governing everything from pump cycles in water treatment plants to turbine speeds in power generation facilities. The original warning urged organizations to disconnect affected devices from the public‑facing internet and to review configurations for signs of tampering. As the geopolitical tension between the United States and Iran entered its fourth month, CISA observed that the activity persisted and evolved, prompting an expanded notice to capture a broader range of vulnerable hardware.
Expansion of Affected Vendors
In its updated alert, CISA clarified that the threat is not limited to Rockwell units. The advisory now warns that attackers may also target PLCs from Schneider Electric, Siemens, and potentially other manufacturers whose devices expose similar industrial protocols to the internet. This widening reflects the attackers’ opportunistic approach: rather than developing custom exploits for a single vendor, they scan for any internet‑reachable PLC that accepts connections on commonly used ports, then attempt to leverage known weaknesses or default credentials. By highlighting additional brands, CISA aims to remind asset owners that the risk surface extends across the OT ecosystem, and that vendor‑specific patches alone cannot guarantee safety.
Nature of the Threat Actor
The intrusions are attributed to cyber units affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC), specifically a group tracked as CyberAv3ngers (also known as the Shahid Kaveh Group). These actors have demonstrated a pattern of focusing on operational technology (OT) to cause physical disruption rather than pure data theft. Their motives align with broader strategic objectives: exerting pressure on critical infrastructure to signal capability, create uncertainty, and potentially influence policy decisions. The group’s use of readily available tools—such as Dropbear Secure Shell (SSH)—underscores a low‑cost, high‑impact methodology that maximizes disruption while minimizing the need for bespoke malware development.
Technical Details of the Intrusion
CISA’s analysis reveals that the attackers first identify PLCs exposed through open network ports, most commonly port 22 for SSH. By employing Dropbear SSH—a lightweight SSH server often embedded in modem firmware—they gain remote shell access to the device. Once inside, the adversaries download the PLC’s project files, which contain the ladder logic or structured text that dictates how the controller interacts with sensors and actuators. They then modify or delete critical segments of this logic, particularly those responsible for emergency shutdowns, safety interlocks, and alarm generation. The resulting configuration can allow the physical process to drift into hazardous conditions—over‑pressurizing a pipeline, over‑speeding a turbine, or bypassing contamination controls—while the human‑machine interface (HMI) fails to warn operators because the alarm logic has been deliberately disabled.
Impact on Critical Infrastructure
Because PLCs directly regulate physical processes, unauthorized changes can translate into real‑world harm. In water facilities, altered logic might permit untreated water to enter distribution networks or cause pumps to run dry, damaging equipment. In energy plants, disabled shutdown logic could prevent turbines from safely tripping during overloads, risking mechanical failure, fires, or even explosions. The absence of alarms means that operators may remain unaware of deteriorating conditions until catastrophic outcomes manifest. CISA emphasizes that even brief periods of unsafe operation can have cascading effects—contaminated water supplies, grid instability, or environmental releases—underscoring the need for preemptive defensive measures.
Recommended Mitigations
To reduce exposure, CISA advises a layered defense strategy. First and foremost, organizations should disconnect PLCs from the public internet unless absolutely necessary; if remote access is required, it must be mediated through hardened jump hosts, virtual private networks (VPNs), or zero‑trust gateways with strong authentication. Second, default passwords on PLCs and associated communication devices must be replaced with complex, unique credentials, and password policies should enforce regular rotation. Third, network segmentation should isolate OT environments from corporate IT networks, limiting lateral movement should a breach occur elsewhere. Fourth, continuous monitoring of PLC project files for unauthorized modifications—using checksums, version control, or integrity‑checking tools—can provide early detection of tampering. Finally, entities should ensure that third‑party service providers are aware of the threat and have incorporated the recommended controls into their maintenance and support procedures.
Importance of Network Segmentation
Segmentation separates the OT zone—where PLCs, sensors, and actuators reside—from the more permeable IT zone that handles email, web browsing, and corporate applications. By enforcing strict firewall rules that allow only approved protocols and ports between these zones, organizations dramatically reduce the attack surface available to internet‑scanning threat actors. Even if an attacker compromises an IT asset, segmentation prevents them from reaching the PLCs unless they can bypass additional controls such as multi‑factor authentication or intrusion‑detection systems. CISA highlights that many successful intrusions observed in the wild relied on flat, flat‑network architectures where OT devices were directly reachable from the internet; adopting a segmented model is therefore a foundational step toward resilience.
Monitoring and Verification Practices
Beyond technical controls, operational vigilance is critical. Organizations should establish baseline configurations for each PLC and employ automated tools that alert administrators when project files deviate from those baselines. Regular audits—both scheduled and trigger‑based—can confirm that safety‑critical logic remains intact and that any changes are documented, reviewed, and approved. Additionally, logging of remote access attempts, successful logins, and command executions on PLCs provides forensic evidence that can be used to investigate incidents and refine defenses. Training operators to recognize anomalous HMI behavior—such as missing alarms or unexpected process values—complements technical monitoring and ensures that human awareness remains a line of defense.
Conclusion and Ongoing Vigilance
The expanded CISA alert serves as a reminder that threats to industrial control systems are evolving, geographically dispersed, and increasingly vendor‑agnostic. Iranian‑affiliated APT groups have shown the capability to weaponize ubiquitous protocols like SSH to infiltrate PLCs, manipulate safety logic, and potentially cause physical harm without triggering conventional alarms. Mitigating this risk requires a holistic approach: reducing internet exposure, hardening credentials, segmenting networks, continuously verifying integrity, and fostering a culture of security awareness among OT personnel. By implementing these measures, critical infrastructure owners can better safeguard essential services against disruption and protect public safety in an increasingly interconnected threat landscape.