Iranian cyberattacks targeting U.S. organizations have increased in tandem with the ongoing war against Iran, the advisory said.
Pro-Iranian hackers have breached critical U.S. infrastructure, according to a joint warning issued Tuesday by several federal agencies.
The advisory came only hours ahead of President Donald Trump’s Tuesday deadline for Iran, warning that “a whole civilization will die tonight” if Iran refuses to open the Hormuz Strait to oil traffic. Trump later suspended the attack following negotiations mediated by Pakistan.
Iranian cyberattacks targeting U.S. organizations have increased recently with the ongoing war against Iran, the advisory said.
In the latest breach, hackers caused disruptions through “malicious interactions” on project files and data displays in organizations across multiple U.S. critical infrastructure sectors, including government services and facilities, local municipalities, water and waste systems, and energy infrastructure.
Hackers exploited vulnerabilities in internet-connected devices used to control machinery in the key U.S. sectors.
“In a few cases, this activity has resulted in operational disruption and financial loss,” reads the advisory, which was issued by the FBI, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, the Environmental Protection Agency, the Department of Energy, and U.S. Cyber Command’s Cyber National Mission Force.
U.S. entities that use the impacted devices, including programmable logic controllers (PLCs) from Rockwell Automation’s Allen Bradley brand, are advised to check their cyber defenses, apply safety measures listed in the warning, and review activity on their networks for indications that they were compromised to avoid the risk of further breaches.
Although the agencies specifically named the Rockwell Automation devices, they said other brands could have been affected as well.
“Due to the widespread use of these PLCs and the potential for additional targeting of other branded [operational technology] devices across critical infrastructure, the authoring agencies recommend U.S. organizations urgently review the tactics, techniques, and procedures and indicators of compromise in this advisory,” the advisory reads.
If U.S. organizations discover they were breached, they are advised to contact appropriate federal agencies for support, risk mitigation, and investigation assistance.
By Troy Myers
