A small western Pennsylvania water authority was just one of multiple organizations breached in the United States by Iran-affiliated hackers who targeted a specific industrial control device because it is Israeli-made, U.S. and Israeli authorities say.
They did not say how many organizations were hacked or otherwise describe them.
Matthew Mottes, the chairman of the Municipal Water Authority of Aliquippa, which discovered it had been hacked on Nov. 25, said Thursday that federal officials had told him the same group also breached four other utilities and an aquarium.
Cybersecurity experts say that while there is no evidence of Iranian involvement in the Oct. 7 attack into Israel by Hamas that triggered the war in Gaza they expected state-backed Iranian hackers and pro-Palestinian hacktivists to step up cyberattacks on Israeli and its allies in its aftermath.
The multiagency advisory explained what CISA had not when it confirmed the Pennsylvania hack on Wednesday - that other industries outside water and water-treatment facilities use the same equipment - Vision Series programmable logic controllers made by Unitronics - and were also potentially vulnerable.
The devices regulate processes including pressure, temperature and fluid flow.
The Aliquippa hack promoted workers to temporarily halt pumping in a remote station that regulates water pressure for two nearby towns, leading crews to switch to manual operation.
The multiagency advisory said it was not known if the hackers had tried to penetrate deeper into breached networks.
The group targeted the Unitronics devices at least since Nov. 22, it said.
An online search Saturday with the Shodan service identified more than 200 such internet-connected devices in the U.S. and more than 1,700 globally.
The advisory notes that Unitronics devices ship with a default password, a practice experts discourage as it makes them more vulnerable to hacking.
Best practices call for devices to require a unique password to be created out of the box.
Experts say many water utilities have paid insufficient attention to cybersecurity.
In response to the Aliquippa hack, three Pennsylvania congressmen asked the U.S. Justice Department in a letter to investigate.
Cyber Av3ngers claimed in an Oct. 30 social media post to have hacked 10 water treatment stations in Israel, though it is not clear if they shut down any equipment.
Since the beginning of the Israel-Hamas war, the group has expanded and accelerated targeting Israeli critical infrastructure, said Check Point's Sergey Shykevich.
Unitronics has not responded to the AP queries about the hacks.
The attack came less than a month after a federal appeals court decision prompted the EPA to rescind a rule that would have obliged U.S public water systems to include cybersecurity testing in their regular federally mandated audits.
The rollback was triggered by a federal appeals court decision in a case brought by Missouri, Arkansas and Iowa, and joined by a water utility trade group.
The Biden administration has been trying to shore up cybersecurity of critical infrastructure - more than 80% of which is privately owned - and has imposed regulations on sectors including electric utilities, gas pipelines and nuclear facilities.
This Cyber News was published on www.securityweek.com. Publication date: Sun, 03 Dec 2023 04:13:05 +0000