In the recently released fact sheet, the Cybersecurity and Infrastructure Security Agency (CISA) and its partners have noticed nation-state threat actors and hacktivists targeting and compromising small-scale OT systems in North American and European Wastewater Systems, Dams, Energy, and Food and Agricultural sectors. These attackers seek to compromise modular, internet-facing Industrial Control Systems (ICS). These systems contain components such as Human-Machine Interfaces (HMI) and Virtual Network Computing software (VNC) that can be exploited through default passwords and remote access software. These attacks are limited to unsophisticated techniques, such as manipulating equipment to create nuisance effects. Although unsophisticated and primitive, these attacks pose a physical threat against any insecure or misconfigured OT environment.

OT environments with internet-facing connections and outdated VNC software can be compromised through open ports. Additionally, HMIs are usually left with factory default passwords or weak passwords, in addition to not having multifactor authentication present. This would allow attackers to access a weakly configured ICS through very basic password attacks. Furthermore, OT environments with legacy or end-of-life can expose unpatched vulnerabilities that could be exploited once the system is discovered. It is crucial that immediate action is taken to update and secure these systems to prevent potential attacks.

Recent Activity

The recent attacks are not just theoretical scenarios. They have real-world consequences. The attacks originated from the compromise of Unitronics program logic controllers in late 2023. This led to wastewater systems in the United Kingdom and the United States being targeted by nation state-sponsored hacktivists. The Aliquippa Water Authority in Pennsylvania experienced a breach, with attackers gaining access to a station that monitored and regulated water pressure. The facility in Erris, Ireland, also suffered a similar attack. The facility used Eurotronics products, a rebranded version of Unitronics PLC and HMI technologies. These incidents underscore the need for immediate action to secure our OT environments.

In early 2024, CISA and partner organizations observed hacktivists targeting vulnerable industrial control systems in North America and Europe. Wastewater Systems experienced limited physical disruptions from an unauthorized user remotely manipulating HMI. These attacks could cause water pumps and blower equipment to exceed their normal operating parameters. In each case for these 2024 attacks, hacktivists maxed out set points, altered settings, deactivated alarm mechanisms, and changed admin passwords to lock out facility operators. Some victims experienced minor tank overflow events; however, reverting to manual controls as soon as a compromise was detected restored operations with minimal complications.

HMI and VNC

HMI are user interfaces connecting the utility operator to the machine, usually a screen. CISA and its partners have observed hacktivists use various techniques to access HMI to compromise OT systems. These attacks revolve around the use of VNC Software. VNC software is a remote access technology that allows users to control other computers remotely. HMI are sometimes configured to have internet-facing ports and services by default through their ICS systems and pre-installed software. These services allow any attacker who discovers these ports to access them, leveraging the VNC Remote Frame Buffer Protocol or VNC over Port 5900 to access HMI using default credentials and weak passwords on accounts not protected by multi-factor authentication. In addition, several of these attacks were HMI with unsupported legacy operating systems or foreign devices rebranded as made-in-the-USA devices, resulting in a lack of patching and consistent update cycles.

Mitigation Plan

CISA has found the leading causes of these attacks to be poor password security and unnecessary exposure to the internet. CISA and its partners advise enacting the following mitigation strategies that align with the Cross-Sector Cybersecurity Performance Goals (CPGs) and the National Institute of Standards and Technology (NIST):

Security by Design

Although steps can be taken to mitigate risks, it is ultimately OT manufacturers' responsibility to build secure products by design. It is advised for OT manufacturers to take ownership of security outcomes and work on the following:

Please visit this link to read the full fact sheet.