Agencies issue updated advisory on Iranian cyber actors targeting programmable logic controllers

The Cybersecurity and Infrastructure Security Agency and other U.S. and international partners July 22 released an updated advisory on Iranian-affiliated cyber actors targeting internet-connected programmable logic controllers, which are computers used to manage and monitor equipment. PLCs can be found in climate control systems, access control systems and many other applications in healthcare. Agencies first warned of malicious activity targeting Rockwell Automation PLCs in April. The updated advisory expands the scope of incidents to include observed targeting of Schneider Electric, Siemens and potentially other manufacturers of PLCs. It also includes new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs.

For more information on this or other cyber and risk issues, contact John Riggi, AHA national advisor for cybersecurity and risk, at jriggi@aha.org, or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at sgee@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.