Cyber Threat Report: 'IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities'

This advisory from CISA and partners describes activity by IRGC-affiliated cyber actors "CyberAv3ngers". According to the advisory, the CyberAv3ngers have been observed exploiting Unitronics Vision Series PLCs in multiple sectors, including U.S. water and wastewater systems. To defend against this threat, the advisory recommends implementing multifactor authentication, using strong passwords, and checking PLCs for default passwords to mitigate malicious activity. The advisory includes technical details like IOCs and TTPs associated with the group, and references to the MITRE ATT&CK framework for further guidance.

Account Use Policies

Configure features related to account use like login attempt lockouts, specific login times, etc.

User Account Management

Manage the creation, modification, use, and permissions associated to user accounts.

Password Policies

Set and enforce secure password policies for accounts.

Multi-factor Authentication

Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.