By AJ Vicens
July 30 (Reuters) – The U.S. government’s civilian cyber defense agency on Thursday warned of a significant increase in hackers targeting technology used to maintain and control water and wastewater systems, and said operators of such systems should remove them from the internet as soon as possible.
The warning comes two days after Minnesota’s state IT agency said more than 30 community water systems in the state were targeted in a “coordinated cyberattack” on July 26 and 27.
U.S. officials and investigators reviewing the matter say it is likely Iranian-linked hackers are behind the Minnesota attacks, the New York Times reported Thursday. Representatives for the Iranian government did not immediately respond to a request for comment.
The attacks come amid an intensification of the war between the U.S. and Iran, with the two sides trading missile attacks, and ongoing threats from both sides for increased destruction.
Iranian-linked hacking activity targeting U.S. water facilities predates the war, but a range of groups have carried out a series of prominent cyberattacks on domestic U.S. organizations, including medical services company Stryker and the Los Angeles County Metropolitan Transportation Authority in March.
The White House referred questions about the Minnesota incidents to the FBI. The FBI did not immediately respond to a request for comment.
State and local officials have said the Minnesota attacks did not threaten water safety, but that in some cases certain systems were taken offline and had to be reset manually. Thursday’s alert from the Cybersecurity and Infrastructure Security Agency warned that hackers have, in some cases, changed passwords to lock out operators and disconnect certain devices from the networks, resulting in “boil water notices and sustained manual operations.”
Minnesota IT Services, the information technology agency for the state’s executive branch, said in a statement that the investigation into the incidents is ongoing. Most of the confirmed cases involved technology that water systems use to remotely monitor and control equipment, including programmable logic controllers (PLCs), and the computer screens operators use to manage them.
John Israel, Minnesota’s chief information security officer, said in the statement that the state has “provided relevant information to the federal government, which is evaluating this activity in the broader national context and leading efforts to determine whether it can be attributed to a specific threat actor.”
IRAN SUSPECTED
Cynthia Kaiser, a former senior FBI cybersecurity official, told Reuters that it was highly likely that the Minnesota hacking campaigns were a continuation of prior Iranian-affiliated targeting of PLCs and other critical infrastructure technology noted by CISA, the FBI, NSA and other federal agencies in an April advisory.
That advisory was updated July 22 to include a wider scope of targeted devices than originally tracked as well as more current techniques and activities carried out by the hackers.
“The fact that a new advisory came out is really indicative of either a broadening of the campaign, new technical details or a renewal of the activity, and probably a combination of all those things,” said Kaiser, now an executive with cybersecurity firm Halcyon.
Chris Day, public sector chief technical officer with cybersecurity firm Tenable, said the Minnesota incidents are “consistent” with the prior Iranian-linked activity, and that the publicly reported information of some systems being taken temporarily offline represents an “interesting escalation” to prior events.
(Reporting by AJ Vicens in Detroit; Editing by Stephen Coates)
Comments