Iranian Hackers Target US Water and Energy Systems, Warns Government
The U.S. government has raised alarms about Iranian state-backed hackers actively infiltrating and disrupting industrial control systems at American water and energy providers. This warning follows earlier alerts from federal agencies regarding a surge in hacking activities linked to Iranian actors amid ongoing conflicts involving Iran, the U.S., and Israel.
In an updated advisory released on Wednesday, the FBI, NSA, Department of Energy, and CISA reported that Iranian hackers are targeting programmable logic controllers on internet-connected operational networks. This intrusion allows them to manipulate data displayed on these systems, leading to outages and operational disruptions.
Initially, the hackers were found to be focusing on controllers manufactured by Rockwell. However, the advisory has since broadened to include industrial control systems from Schneider Electric and Siemens. The agencies caution that virtually all internet-exposed industrial control systems could be vulnerable and have urged owners of critical infrastructure to take immediate protective measures. The advisory indicates that these Iranian-backed hackers are conducting their activities to create disruptive effects within the United States, likely as a reaction to the ongoing geopolitical tensions.
The FBI reported that the hackers successfully breached one critical infrastructure provider, altering the programming logic of controllers to disable processes responsible for critical shutdowns and alarms. This manipulation allowed systems to enter unsafe conditions without alerting operators to the anomalies.
This incident is part of a broader pattern of cyberattacks attributed to Iranian government hackers and their affiliates since the onset of the war in February. These attacks have varied from traditional espionage and hack-and-leak operations, such as the exposure of personal emails belonging to FBI director Kash Patel, to more destructive hacks that have caused significant damage. A notable incident involved a cyberattack on medical technology company Stryker, where the Iranian hacking group known as Handala remotely wiped tens of thousands of employee devices.
Handala also claimed responsibility for a data breach affecting California's Cal Water in June, asserting that it could have disrupted the water supply, although the water provider reported no evidence of unauthorized access to its operational networks. The situation underscores the ongoing threat posed by state-backed hackers and the importance of robust cybersecurity measures in protecting critical infrastructure.
