Controllers on the public internet, still holding the password they shipped with
Iranian-affiliated actors have been reaching programmable logic controllers directly over the internet at US water and wastewater utilities, energy organisations and local municipalities, and changing what those controllers do. CISA names Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 and Siemens S7-1200, and says other manufacturers are likely in scope. There is no exploit to write about. The devices were exposed, they still held their default authentication keys and passwords, and from there the actors altered project files, manipulated what the operator saw on the HMI and SCADA displays, and disabled shutdown and alarm logic.
What worked
The advisory does not say. It is written as a hardening document rather than an incident narrative and names no detection or control that limited the activity at any victim.
What failed
Everything in front of the controller. CISA’s own account of the exposure is that these were "internet-exposed PLCs" on "devices that lacked sufficient network and/or hardening security controls", still carrying "default authentication keys and passwords".
The more interesting failure is the one that came after. Disabling shutdown and alarm logic while editing what the operator’s screen displays takes out the loop that keeps a plant safe and the loop that tells a person something is wrong, at the same time. The physical process and the picture of the physical process are then free to drift apart with nobody in a position to notice, which is a different category of problem from data theft and does not resolve itself when the intrusion is evicted.
And the pattern is not new. CISA cites the 2023 CyberAv3ngers campaign against US Unitronics devices as the precedent, and the exposure that made that possible is the exposure being used now.
The number
75 devices
compromised in the 2023 CyberAv3ngers campaign against US Unitronics controllers, which CISA cites here as the same exposure being exploited again three years later.
What to do instead
Take them off the internet. Everything else on CISA’s list is secondary to that and the advisory puts it first: put the controller behind a secure gateway, and if it reaches the world through a cellular modem, secure that modem with strong authentication and turn its logging on. That modem is a second internet connection, and it is usually missing from the asset inventory because nobody in IT provisioned it.
Then the two physical steps, which cost nothing and are the ones most often skipped. Put the mode switch in run position. Enable programming protection in the configuration software. A controller sitting in remote-programmable mode with no programming password is a controller that anybody who can reach it can rewrite, and no firewall rule compensates for that.
Then verify the logic rather than the device. If you were exposed, the question is not whether the PLC is patched but whether its project file still says what your engineers wrote. Use the vendor’s integrity tooling to compare against a known-good copy, and check specifically that the shutdown and alarm logic is present and enabled. The manipulated display is precisely why you cannot answer this from the control room.
Then the rest of the list: change the default passwords, add multi-factor authentication where the platform supports it, block Telnet, FTP, RDP, VNC and any web service you are not using, and keep offline backups of the project files that somebody has actually restored from at least once.
- PrimaryCISA AA26-097A