A July 22 update to a joint federal cybersecurity advisory confirmed that the campaign has moved beyond Rockwell Automation’s Allen-Bradley controllers. The affected equipment now includes Schneider Electric BMX P34 and Modicon M340 programmable logic controllers, as well as Siemens S7-1200 devices. Other brands may also be exposed where controllers can be reached directly from the internet.
The attackers have caused operational disruption and financial losses by extracting project files, interfering with control logic and manipulating information shown on human-machine interface and supervisory control and data acquisition displays. Such screens allow plant operators to monitor processes including water pressure, pumping, power distribution and industrial machinery.
Federal investigators assess that the hackers intend to create disruptive effects inside the United States. The activity has affected local government services, water and wastewater systems, energy operations and other industrial automation environments. The advisory does not identify the affected organisations or disclose the scale of the financial losses.
The campaign was first detailed on April 7, when authorities warned that Rockwell Automation CompactLogix and Micro850 controllers were being targeted. The broader July assessment reflects additional investigations and engagement with victims, showing that the operation spans several manufacturers and communication protocols.
Hackers used overseas internet addresses and leased hosting infrastructure to connect to exposed controllers. In some attacks, they employed legitimate engineering software, including Rockwell Automation’s Studio 5000 Logix Designer, rather than relying on an unknown software flaw. The approach allowed them to establish connections accepted by poorly protected devices and interact with project files governing industrial processes.
The threat actors also deployed Dropbear Secure Shell software on compromised endpoints, creating a channel for remote access through port 22. Investigators detected malicious or suspicious traffic involving ports 44818 and 2222, commonly associated with Rockwell systems; port 102, used by Siemens industrial communications; and port 502, widely linked to Modbus-based equipment.
The expanded advisory was jointly issued by the FBI, Cybersecurity and Infrastructure Security Agency, National Security Agency, Environmental Protection Agency, Department of Energy, US Cyber Command’s Cyber National Mission Force and the Treasury Department. Operators have been urged to examine historical logs against newly published indicators of compromise and check for unexplained configuration changes.
Authorities have not publicly attributed the operation to a named group. They assessed that the actors are affiliated with Iran and noted similarities to previous campaigns by CyberAv3ngers, also known as the Shahid Kaveh Group. That organisation has been linked to the Islamic Revolutionary Guard Corps Cyber-Electronic Command.
CyberAv3ngers compromised at least 75 US-based devices during a campaign that began in November 2023. Those attacks concentrated on Israeli-made Unitronics controllers used by water utilities and other infrastructure operators. Some facilities were forced to switch to manual operations after their control systems were breached.
The current activity indicates a shift towards a wider range of industrial hardware. By using standard programming tools and exposed communications services, attackers can exploit weak deployment practices without necessarily developing zero-day vulnerabilities. Direct internet access, unchanged default settings and insufficient network segmentation remain central weaknesses.
Operators have been told to remove controllers from public internet exposure and place secure gateways, firewalls or jump hosts between industrial equipment and external networks. Remote access should require multifactor authentication, while cellular modems used at field sites should carry strong credentials, updated software and active logging.
Controllers with physical operating-mode switches should be kept in the “run” position except during authorised programming. This can prevent remote changes to control logic. Siemens users have been advised to activate programming protection through the company’s Totally Integrated Automation Portal, while Schneider Electric operators have been directed to review security guidance for the Modicon platform.
Defenders are also being asked to maintain offline backups of controller logic and configuration files, disable unused services such as Telnet, FTP, remote desktop and web management, and restrict communications to authorised engineering workstations. Monitoring systems should flag unusual logins, unexpected industrial protocols and unauthorised changes to reusable code modules.
Water utilities face particular challenges because many serve small communities with limited cybersecurity budgets and ageing equipment. The Environmental Protection Agency has been providing technical guidance and no-cost support to help operators identify exposed assets and strengthen recovery planning.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
