IRAN‑linked hackers have compromised internet‑exposed water and energy control systems across several US states, gaining access to programmable logic controllers and disabling critical safety alarms. The intrusion was flagged by a joint advisory from CISA, the FBI, the NSA and the Department of Energy, which warned that the attackers are manipulating operational data to mask abnormal conditions.
By altering ladder‑logic code they can change pump speeds, valve positions and pressure readouts while silencing trips that would normally alert operators. The activity poses a direct risk to public safety and the reliability of essential services.
According to the advisory, the intruders scan for programmable logic controllers that are reachable from the public internet, then log in using default or weakly protected credentials. Once inside they edit the control program, adjusting set points and disabling alarm and shutdown logic that would trigger on dangerous conditions. Although no CVE identifier is attached to this method, the effect is identical to exploiting a vulnerability because it allows unauthorized command of physical processes. The changes are often invisible to standard monitoring unless integrity checks are performed on the controller code.
The manipulated controllers can cause pumps to run beyond safe limits, valves to open or close incorrectly, and pressure sensors to report false values while safety trips remain silent. This creates a scenario where physical damage, service interruptions or environmental releases could occur without any warning to operators. German law enforcement announced they had disrupted a phishing group known as Kratos, which is believed to have supplied stolen credentials used in some of these intrusions. The Security Affairs newsletter Round 587 covered the incident alongside other notable cyber developments.
A separate Security Affairs article described how the adversaries specifically targeted internet‑facing PLCs in water treatment plants and power distribution substations, rewriting code that governs emergency shutdown sequences. The joint alert urged owners to segment operational technology networks, enforce multifactor authentication for remote access and replace any factory‑set passwords with strong unique alternatives. It also recommended continuous monitoring for unauthorized program edits and regular integrity checks of controller firmware. Sharing indicators of compromise with federal agencies was highlighted as a key step to hinder further activity.
Defenders should begin by inventorying all OT devices that expose a web interface or remote‑management port to the internet and immediately place those behind a virtual private network or firewall with strict rule sets. Default credentials must be replaced, and where possible, multifactor authentication should be enforced for any administrative login. Network traffic to and from PLCs should be logged and analysed for anomalies such as unexpected changes to ladder‑logic or alarm configurations. Finally, participating in industry information‑sharing groups and reporting suspicious activity to CISA helps build a clearer picture of the threat and protects other critical‑infrastructure operators.