Three months earlier, the U.S. cybersecurity agency also said threat actors were trying to breach critical infrastructure networks (including water and wastewater systems) by targeting Internet-exposed industrial devices using default credentials and "unsophisticated" methods like brute force attacks. "CISA is increasingly aware of unsophisticated cyber actor(s) targeting ICS/SCADA systems within U.S. critical Infrastructure sectors (Oil and Natural Gas), specifically in Energy and Transportation Systems," the cybersecurity agency noted. The agency advised security teams to ensure that their organizations' attack surface is as small as possible by removing public-facing OT devices from the internet, because threat actors can easily find and compromise them because they lack modern authorization and authentication methods that could protect against hacking attempts. In a joint advisory issued with the FBI, the Environmental Protection Agency (EPA), and the Department of Energy (DOE), CISA also shared detailed guidance to help network defenders reduce the risk of potential breaches. While these attacks use very basic tactics to compromise their targets' industrial control systems (ICS) and operational technology (OT) equipment, CISA also cautioned that they could still lead to significant impact, including physical damage and disruptions. CISA warned critical infrastructure organizations of "unsophisticated" threat actors actively targeting the U.S. oil and natural gas sectors. CISA also recommended changing default passwords to unique and strong ones and securing remote access to OT assets by using a virtual private network (VPN) featuring phishing-resistant multifactor authentication (MFA). The joint advisory also advises segmenting IT and OT networks using demilitarized zones to separate local area networks from untrusted networks, and practicing reverting to manual controls to quickly restore operations in the event of an incident. "Business continuity and disaster recovery plans, fail-safe mechanisms, islanding capabilities, software backups, and standby systems should all be routinely tested to ensure safe manual operations in the event of an incident," the agencies said.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 07 May 2025 13:20:01 +0000