In a joint statement from the Federal Bureau of Investigation (FBI), the Cyber and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), and the Israel National Cyber Directorate (INCD), an Iranian military organization is behind recent cyber attacks across several industries in the United States.
According to the release, Iranian Government Islamic Revolutionary Guard Corps (IRGC) is actively targeting and compromising Israeli-made Unitronics Vision Series programmable logic controllers (PLCs). The United States designated IRGC as a foreign terrorist organization in 2019.
The PLCs are commonly used in the water and wastewater industries and are additionally utilized across food, healthcare, and food and beverage industries. The CISA noted the PLCs may be rebranded and appear as different providers or manufacturers.
PLCs are often used across in the water industry to control and monitor various stages of water and wastewater treatment. This often includes using the controllers to turn pumps on and off, control the flow of chemicals, gather and record data, and issue alerts to users. Attempts to compromise the technology can threaten a system's ability to safely and efficiently send water to and from its communities.
IRGC actors are using the persona "CyberAv3ngers" and have been targeting the default PLCs since at least Nov. 22, 2023. According to the statement, "The IRGC-affiliated cyber actors left a defacement image stating, 'You have been hacked, down with Israel. Every equipment ‘made in Israel’ is CyberAv3ngers legal target.”
The victims span across multiple U.S. states.
The CISA urges all organizations with these PLCs to implement the following mitigation tactics:
The CISA has additional resources to prevent or report potential attacks. Contact us today with any security questions you may have about your critical infrastructure and to learn more about upgrading to our award-winning IPC-based system.