US warns Iranian hackers target Siemens, Schneider, Rockwell ICS devices
This digest was compiled by AI from multiple sources — links to the originals are below.
The US government updated a cybersecurity advisory on July 22, warning that Iranian hackers are targeting industrial control systems made by Siemens, Schneider Electric, and Rockwell Automation. The hackers have compromised programmable logic controllers, disabling safety logic and manipulating HMI displays. The advisory expands on an initial April warning, adding new vendors and indicators of compromise.
The Attack Method
Iranian APT actors used configuration software to download malicious project files to PLCs, including Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 series. The attackers targeted ports 44818, 2222, 102, 502, and 22, connecting via manufacturers' programming software and leased third-party infrastructure. In one US victim case, the malicious file retained ladder logic for downstream function but overrode instructions maintaining safe operating parameters.
Impact on Safety Systems
The hackers extracted and exfiltrated PLC project files, then modified and deleted logic, including add-on instructions. They manipulated data on HMI and SCADA displays, disabling critical shutdown and alarm logic. This allowed systems to enter unsafe conditions without operator notification, according to the advisory.
Iranian Hacktivist Personas
The Iranian government has used hacktivist personas like CyberAv3ngers to carry out many ICS/OT attacks. The group has been active for years, targeting critical infrastructure. The updated advisory includes new detection guidance and indicators of compromise.
What's Next
The US agencies urge organizations to review the updated advisory and implement the recommended mitigations. It remains unclear whether further attacks have occurred since the initial April warning or if additional vendors will be targeted.
1 source
US warns Iranian hackers target Siemens, Schneider, Rockwell ICS devices
