Threats Tagged 'critical infrastructure'

Multiple federal agencies have updated a joint advisory warning of active exploitation targeting programmable logic controllers (PLCs) in U.S. critical infrastructure. Attackers scan for internet-exposed industrial control systems and connect using legitimate engineering software with valid credentials, appearing as authorized technicians. Once inside, they alter controller logic and manipulate operator displays to hide anomalies. The campaign has expanded beyond Rockwell Automation to include Schneider Electric and Siemens equipment. Unlike a similar 2023 campaign that caused minimal disruption, this ongoing activity has resulted in confirmed operational disruption and financial losses. Targeted sectors include government facilities, water systems, and energy infrastructure. The exploitation leverages architectural weaknesses rather than software vulnerabilities, with attackers accessing systems through ports 22, 102, 502, 2222, and 44818.

MediumMalwareUnited States#industrial control systems#critical infrastructure#water facilities

This article provides a detailed analysis of the recent cyber attack involving the Kudankulam Nuclear Power Plant, focusing on a data breach via a third-party contractor's server. It outlines the scope of leaked files, the ransomware group responsible, and NPCIL's official response emphasizing that critical nuclear safety systems were not compromised. The report highlights supply chain risks and ongoing investigations by CERT-In.