Feds: Iran-Linked Hackers Are Targeting Water, Energy Systems

Federal officials are flagging a fresh wave of Iran-linked hacking aimed at core US infrastructure, but they're leaving plenty of blanks unfilled. In a Tuesday alert, the Cybersecurity and Infrastructure Security Agency said hackers tied to Iran's Islamic Revolutionary Guard Corps have launched cyber operations against water and energy systems, with the stated goal of causing disruption inside the United States.

• The advisory, however, was "vaguely worded" and did not identify which facilities were hit, the New York Times reports. "In a few cases, this activity has resulted in operational disruption and financial loss," the alert said, without describing the damage.

• The advisory instead zeroed in on the hardware: so-called programmable logic controllers made by Rockwell Automation, widely used to run industrial equipment. Operators were urged to ensure those devices aren't exposed to the internet.
• The notice did not address controllers made by Siemens, which were exploited in the US-Israeli cyberattack on Iran's nuclear program more than a decade ago—the operation that helped spur Iran to build its own offensive hacking units, the Times reports.
• The advisory didn't name a specific hacking group, but warned of "Iranian-affiliated advanced persistent threat actors." It linked the activity to the Iran war, saying "targeting campaigns against US organizations have recently escalated, likely in response to hostilities," Politico reports.
• The alert was jointly produced by the CISA, the National Security Agency, the FBI, US Cyber Command, the Department of Energy, the Environmental Protection Agency, and the Cyber National Mission Force.