CISA, FBI Alert: Iran‑Linked Hackers Broaden Focus to Water and Energy Infrastructure

Key Takeaways

• Iran‑affiliated hackers are intensifying attacks on programmable logic controllers (PLCs) that manage water, energy, and other municipal infrastructure.
• The threat now targets devices from Schneider Electric, Siemens, and other manufacturers in addition to Rockwell/Allen‑Bradley PLCs.
• Exploited vulnerabilities include an authentication bypass in Rockwell’s Studio 5000 Logix Designer (CVE‑2021‑22681) and the use of Dropbear Secure Shell for remote access.
• Agencies (CISA & FBI) urge strict access controls, validation of PLC project files, multifactor authentication, password changes, patching, and network segmentation.
• Recent incidents, such as the Handala group’s claim against California Water Service, show attackers can reach operational technology (OT) via third‑party service providers or stolen credentials, though impact on core OT systems was limited in that case.
• Continuous monitoring, adherence to vendor hardening guides, and a defense‑in‑depth approach are essential to protect critical OT environments.

Overview of the Updated Threat Advisory

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released an updated advisory warning that Iran‑linked threat actors are expanding their campaign against industrial control systems. Initially focused on Rockwell Automation/Allen‑Bradley programmable logic controllers (PLCs), the advisory now confirms that Schneider Electric BMX P34/Modicon M340 and Siemens S7‑1200 series PLCs are also being targeted. The agencies stress that the goal of these intrusions is to disrupt water, energy, and other municipal infrastructure by gaining unauthorized access to the devices that govern physical processes.

Evolution of the Attack Surface

Originally, the advisory highlighted an authentication bypass vulnerability in Rockwell’s Studio 5000 Logix Designer software (tracked as CVE‑2021‑22681). Exploitation of this flaw could allow an attacker to discover a cryptographic key, enabling a non‑Rockwell application to communicate with the controller. Since March, threat actors have broadened their toolkit, employing Dropbear Secure Shell (SSH) software to establish remote footholds on compromised networks. This shift indicates a move from exploiting a single vendor‑specific flaw to leveraging more generic remote‑access techniques that can work across multiple PLC families.

Targeted Sectors and Observed Incidents

Iran‑linked groups have been observed probing U.S. water systems since the outset of the Gaza conflict in 2023. An Environmental Protection Agency (EPA) investigation uncovered hundreds of water and energy facilities exhibiting critical or high‑severity vulnerabilities. In April, authorities confirmed that several water and energy sites had already suffered intrusions that resulted in financial losses and operational damage. Most notably, in June the hacking collective Handala—tied to Iranian intelligence—claimed responsibility for an attack on California Water Service (Cal Water). Cal Water reported that the breach was limited to specific accounts on two third‑party service‑provider platforms; no direct impact was observed on its internal IT or OT networks. The attackers gained entry by using stolen credentials to log into a customer’s online account.

How Attackers Reach OT Environments

Harry Thomas, co‑founder and CTO of Frenos, emphasized that once an adversary obtains a credential, compromises a workstation, or infiltrates through a service provider, the central question becomes whether they can pivot to the controllers, engineering workstations, and other “operational crown jewels.” In the Cal Water case, the attackers stayed within the third‑party portal and did not progress to the PLC layer. However, the advisory warns that many organizations lack sufficient segmentation between corporate IT, vendor portals, and OT networks, providing a plausible path for attackers to reach critical devices once an initial foothold is secured.

Recommended Defensive Measures

CISA and the FBI outline a series of hardening steps that organizations should implement immediately:

1. Strict Access Controls – Limit who can interact with PLCs to only essential personnel and enforce least‑privilege principles.
2. Multifactor Authentication (MFA) – Require MFA for any remote or privileged access to PLC management interfaces.
3. Credential Hygiene – Change default passwords, enforce strong, unique passwords, and rotate them regularly.
4. Patch Management – Apply the latest security patches from PLC vendors, especially for Studio 5000 Logix Designer and related engineering software.
5. Network Segmentation – Deploy firewalls, virtual private networks (VPNs), network proxies, or gateways to isolate PLCs from the open internet and from less‑trusted corporate zones.
6. Validation of Project Files – Routinely review the logic and configuration files running on PLCs for signs of unauthorized modifications or malicious code.
7. Monitoring and Logging – Enable comprehensive logging of PLC access attempts and correlate logs with SIEM solutions to detect anomalous behavior early.

Role of Vendors and Ongoing Collaboration

A Rockwell Automation spokesperson confirmed that the company has been working closely with CISA, the FBI, and other PLC vendors since the original advisory was issued. Rockwell urges customers to revisit its 2021 and early‑2024 security advisories, which detail mitigation steps for the CVE‑2021‑22681 vulnerability and related risks. Similarly, Schneider Electric and Siemens have published hardening guides specific to their BMX P34/Modicon M340 and S7‑1200 families, recommending disabling unused services, enforcing secure boot, and employing signed firmware where available.

Lessons from Recent Incidents

The Handala incident underscores that even when attackers fail to reach the OT layer, the mere compromise of third‑party service‑provider accounts can serve as a stepping stone. Organizations must therefore extend their security posture beyond the plant floor to include vendor portals, remote support tools, and any external interfaces that could be abused. Regularly reviewing third‑party access agreements, enforcing MFA on those platforms, and conducting periodic penetration tests on the extended attack surface are critical complements to internal OT hardening.

Conclusion

The updated CISA/FBI advisory makes clear that Iran‑affiliated actors are actively seeking to exploit PLCs across multiple manufacturers to jeopardize essential water, energy, and municipal services. While some observed intrusions have remained confined to peripheral accounts, the underlying tactics—credential theft, remote‑access tools like Dropbear, and vendor‑specific vulnerabilities—demonstrate a persistent and evolving threat. By adopting the recommended controls—strong authentication, diligent patching, rigorous network segmentation, and continuous validation of PLC configurations—organizations can significantly reduce the likelihood of a successful intrusion and protect the operational integrity of their critical infrastructure.