Iranian Threat Actors Disrupt US Critical Infrastructure via Exposed PLCs

Iran-affiliated threat actors are disrupting US critical infrastructure through attacks on Internet-exposed operational technology (OT) devices across numerous sectors, the US government is warning. 

The revelation came Tuesday, just before the US and Iran reached a tentative two-week ceasefire agreement in the ongoing war. The campaign by Iranian advanced persistent threat (APT) actors, which began last month, soon after the US and Israel jointly attacked Iran, targets programmable logic controllers (PLCs) — particularly Rockwell Automation/Allen-Bradley devices — used in energy, water and wastewater, and government facilities, according to a joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA) and other agencies.