Iran-Linked Hackers Disrupt U.S. Critical Infrastructure by Targeting Internet-Exposed PLCs

TL;DR

U.S. intelligence agencies have issued an urgent warning regarding Iranian-affiliated cyber actors targeting internet-facing operational technology (OT). By exploiting exposed Programmable Logic Controllers (PLCs), attackers have caused operational disruptions, manipulated data displays, and inflicted financial losses across the water, energy, and government sectors.

The Escalation of OT Cyber Attacks

U.S. cybersecurity and intelligence agencies, including the FBI, have confirmed a recent surge in cyber operations orchestrated by Iranian hacking groups. These attacks are primarily directed at U.S. organizations and represent a strategic response to ongoing geopolitical conflicts involving Iran, the United States, and Israel.

According to a statement released by the FBI on X (formerly Twitter), these activities have led to "diminished PLC functionality, manipulation of display data and, in some cases, operational disruption and financial loss."

Targets and Tactics

The campaign specifically targets internet-facing Programmable Logic Controllers (PLCs) which are essential for industrial automation. The agencies highlighted that the actors have singled out:

Rockwell Automation and Allen-Bradley PLCs (specifically CompactLogix and Micro850 devices).
Sectors Impacted: Water and Wastewater Systems (WWS), Energy, and Government services/facilities.

The Attack Lifecycle

The attackers utilize leased, third-party hosted infrastructure to launch their operations. Their methodology involves several sophisticated steps:

Direct Interaction: Actors use configuration software, such as Rockwell Automation’s Studio 5000 Logix Designer, to create an accepted connection to a victim's PLC.
C2 Establishment: Upon gaining access, the threat actors deploy Dropbear, a Secure Shell (SSH) software, to enable remote access through port 22.
Data Manipulation: Once remote access is established, the attackers extract device project files and manipulate data on Human-Machine Interface (HMI) and Supervisory Control and Data Acquisition (SCADA) displays.

A Pattern of Disruptive Behavior

This is not an isolated incident. In late 2023, the group "Cyber Av3ngers" (also known as Hydro Kitten or Shahid Kaveh Group) exploited Unitronics PLCs, compromising at least 75 devices, including those at the Municipal Water Authority of Aliquippa in Pennsylvania.

Industry experts note that this is a continuation of a known playbook. Sergey Shykevich of Check Point Research stated that identical targeting patterns were observed against Israeli PLCs earlier this year. The shift indicates that Iranian actors are moving faster and broader, targeting both IT and OT infrastructure simultaneously.

The Role of Cyber Proxies and Influence Operations

Recent reports from Flashpoint and DomainTools Investigations (DTI) suggest that many of these "hacktivist" personas, such as Homeland Justice and Handala Hack, are actually a "single, coordinated cyber influence ecosystem" aligned with Iran’s Ministry of Intelligence and Security (MOIS).

These groups use Telegram and public-facing domains to amplify their impact through "hack-and-leak" operations and Distributed Denial-of-Service (DDoS) attacks. This ecosystem allows the Iranian state to preserve infrastructure continuity while segmenting their messaging for strategic effect.

Collusion with the Cybercrime Ecosystem

Further complicating the threat landscape is the blurred line between state actors and criminal enterprises. MuddyWater, an Iranian state-sponsored group, has been linked to the use of "CastleRAT," a remote access trojan that is part of a Russian criminal Malware-as-a-Service (MaaS) framework.

Advanced components of this platform include:

ChainShell: A JavaScript-based malware that uses the Ethereum blockchain to retrieve Command-and-Control (C2) addresses.
Tsundere: A botnet malware often deployed alongside ChainShell.

By using commercial offensive tools, state actors can complicate attribution efforts and enhance their technical capabilities.

Recommended Defense Measures

To mitigate the risk of these OT-focused attacks, the advisory recommends that organizations implement the following security controls:

Eliminate Internet Exposure: Avoid exposing PLCs directly to the public internet.
Prevent Remote Modification: Use physical or software switches to block unauthorized remote changes to PLC logic.
Access Control: Implement Multi-Factor Authentication (MFA) and deploy firewalls or network proxies in front of OT devices.
Hygiene and Monitoring: Keep PLC firmware up to date, disable unused authentication features, and actively monitor network traffic for anomalies.

Conclusion

The targeting of U.S. critical infrastructure by Iran-linked actors marks an accelerating threat to national security and public safety. By leveraging internet-exposed OT devices and integrating with the broader cybercrime ecosystem, these actors have demonstrated an ability to cause tangible physical and financial disruption. Organizations operating in critical sectors must prioritize the isolation and hardening of their industrial control systems to defend against these evolving state-directed operations.

Source: The Hacker News