Iranian Cyber Actors Exploit PLCs in Critical Infrastructure

Since at least November 2023, Iranian-affiliated advanced persistent threat (APT) actors, including CyberAv3ngers (aka Shahid Kaveh Group), have been targeting internet-exposed programmable logic controllers (PLCs) across multiple U.S. critical infrastructure sectors. These actors, linked to the IRGC Cyber Electronic Command, specifically target OT devices to cause operational disruptions and financial loss.

The technical workflow involves identifying internet-facing PLCs and modems, exfiltrating device project files using vendor configuration software, and modifying ladder logic to override safe operating parameters. This activity has evolved from targeting Unitronics devices to include Rockwell Automation, Schneider Electric, and Siemens PLCs, emphasizing a broadening of the threat actor's technical capabilities and targeting scope.

The impact is critical, as modified project files can disable shutdown alarms and safety logic, potentially leading to physical damage or unsafe operating conditions in water, energy, and government sectors. Organizations are urged to move OT devices behind secure gateways and implement physical mode switches on controllers.