Iran-Backed Hackers Target US Critical Infrastructure, Disrupt Operations
Iranian-affiliated hackers have been targeting US critical national infrastructure (CNI) providers, causing operational disruptions and financial losses. According to a Cybersecurity and Infrastructure Security Agency (CISA) advisory, these threat actors have been focusing on internet-facing operational technology (OT) assets, including programmable logic controllers (PLCs) from Rockwell Automation/Allen-Bradley. The sectors affected include government services, water and wastewater systems, and energy. The hackers have been manipulating data on human-machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. They use configuration software to establish connections to targeted PLCs via overseas IP addresses. CISA has urged US organizations to review tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to mitigate risks. 
