US agencies have updated a warning about Iran-linked hackers targeting internet-exposed industrial controllers, TechCrunch reported. In some cases, the intrusions caused operational disruption and financial losses.
The warning identifies affected organisations in the water and wastewater, energy, government services and municipal infrastructure sectors. It does not say that every US provider in those sectors was attacked.
Authorities had previously observed activity focused largely on Rockwell Automation and Allen-Bradley controllers. The update adds Schneider Electric and Siemens devices and says programmable logic controllers from other manufacturers may also be at risk when exposed to the internet.
The attackers extracted and altered controller project files and manipulated data in HMI and SCADA systems. In some cases, changes disabled emergency-stop and alarm logic, potentially leaving operators unaware that equipment had entered an unsafe state.
US agencies assess that the group is seeking to cause disruptive effects inside the country. They say the recent escalation is likely linked to Iran’s conflict with the United States and Israel, preserving this as an assessment rather than an established cause of every intrusion.
Organisations were advised to remove controllers from direct internet exposure, restrict network access, review project files and event logs, and follow manufacturers’ security guidance.
