The updated alert says attackers have gained access to programmable logic controllers, or PLCs, which manage physical processes inside critical infrastructure. Intruders have downloaded malicious project files, altered control logic and manipulated information shown on operator displays, creating risks of disruption, financial losses and unsafe operating conditions.
Investigators identified attacks involving Siemens S7-1200 series controllers, Schneider Electric Modicon M340 devices and Rockwell Automation CompactLogix and Micro850 systems. Equipment produced by other manufacturers may also face exposure where controllers are connected directly to the internet or protected by weak authentication.
PLCs are specialised computers that operate pumps, valves, motors, alarms and automated production systems. They are widely deployed in water treatment facilities, power networks, factories, pipelines and transport infrastructure. A successful intrusion can therefore move beyond stolen data and affect machinery, essential services or industrial safety.
One compromised US infrastructure operator was found to have a malicious project file installed through legitimate configuration software. The file preserved enough normal logic to keep downstream functions working, while adding instructions that overrode controls designed to maintain safe operating limits.
The changes disabled shutdown processes and alarm functions, allowing equipment to enter unsafe states without warning staff through normal monitoring screens. Attackers also altered data presented through human-machine interfaces and supervisory control and data acquisition systems, potentially giving operators a misleading picture of plant conditions.
The hackers targeted commonly used communications ports, including 44818, 2222, 102, 502 and 22. They connected through manufacturer programming tools and infrastructure rented from third-party hosting providers, a method that can make malicious traffic resemble legitimate remote engineering activity.
Software involved in the intrusions included Siemens TIA Portal, Schneider Electric EcoStruxure Control Expert and Rockwell Automation Studio 5000 Logix Designer. These platforms are routinely used by engineers to configure controllers, upload operational logic and maintain industrial processes.
The campaign marks an expansion from earlier attacks centred on Allen-Bradley equipment. The inclusion of Siemens and Schneider Electric shows that the activity is not tied to a single product weakness. Instead, the attackers appear to be searching broadly for exposed industrial devices, insecure remote access and poorly separated operational networks.
US authorities assess that the activity is intended to cause disruptive effects rather than conduct conventional espionage alone. The warning comes amid military confrontation involving Iran, the United States and Israel, raising concern that cyber operations could be used as an asymmetric response against civilian infrastructure.
Iranian cyber operations have often combined state-directed activity with hacktivist branding, proxy groups and criminal-style tactics. That structure can complicate attribution while allowing Tehran-linked operators to deny direct responsibility. Groups using names such as CyberAv3ngers and Handala have previously claimed attacks against industrial, transport, healthcare and water organisations.
CyberAv3ngers drew attention for intrusions involving internet-facing water control equipment, including systems linked to Israeli technology. Handala has claimed destructive and data-theft operations against US organisations, although some of its assertions about access to operational networks have not been independently demonstrated.
The widening focus on control systems reflects a broader shift in cyber conflict. Industrial networks were once isolated from public communications infrastructure, but remote maintenance, cloud monitoring, cellular connections and digital transformation have increased their exposure. Ageing equipment and operational demands can also make patching difficult because controllers often run continuously for years.
Operators have been urged to remove direct internet access, identify every externally reachable device and place industrial systems behind properly configured firewalls. Remote access should require multifactor authentication, encrypted connections and tightly controlled engineering accounts.
Defenders are also being advised to preserve trusted copies of controller logic, compare running programmes with approved versions and monitor unexplained changes to project files, alarm settings and display data. Network traffic involving engineering software should be reviewed for connections to unfamiliar hosting providers or unusual access outside maintenance periods.
Facilities must also separate business networks from operational technology environments so that a compromise of email, office systems or remote user credentials cannot easily reach industrial equipment. Default passwords should be replaced, unused services disabled and access limited to authorised personnel and designated management stations.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
