The Cybersecurity and Infrastructure Security Agency, FBI and five other federal partners have updated a joint advisory warning that Iranian-affiliated hackers are now targeting programmable logic controllers made by Siemens and Schneider Electric.
The July 22 update adds guidance for detecting malicious changes to reusable code modules in Rockwell Automation PLC programs and flags targeting of Schneider Electric’s Modicon M340 and Siemens’ S7-1200 series controllers, alongside Rockwell’s CompactLogix and Micro850 devices. The agencies said Iranian-affiliated actors have exploited the internet-connected controllers since at least March by altering project files and manipulating data on human-machine interface and supervisory control and data acquisition displays, causing operational disruption and financial loss at some victim organizations.
Programmable logic controllers are used across healthcare in climate control and access control systems, according to the American Hospital Association, which flagged the update for hospital cybersecurity teams.
“Iranian cyber actors continue to target U.S. critical infrastructure, and the FBI is committed to identifying, disrupting, and imposing costs on those responsible,” said Brett Leatherman, assistant director of the FBI’s Cyber Division, in a news release.
The advisory follows a wider pattern of Iranian-linked activity against U.S. healthcare-adjacent targets in 2026, including a March cyberattack on medical device maker Stryker. Hospitals and health systems using affected brands are urged to remove the devices from direct internet exposure and review logs for the newly published indicators of compromise.
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.