Iranian state-sponsored group MuddyWater, affiliated with the Ministry of Intelligence and Security, is actively targeting U.S. critical infrastructure by exploiting internet-exposed Rockwell Automation Programmable Logic Controllers (PLCs). The attackers leverage these exposed OT interfaces to deploy SSH backdoors for persistent access. Once established, they manipulate SCADA display data to deceive industrial operators, masking the actual state of physical processes within the water, energy, and government sectors. This activity, detailed in CISA/FBI Joint Advisory AA26-097A, represents a direct effort to facilitate operational disruptions through the manipulation of Industrial Control Systems (ICS).

• Incident Overview: Campaign Scope

  • Targets include Water and Wastewater Systems, Energy Infrastructure, and various Government Facilities.
  • Geographic focus is concentrated within the United States.
  • Primary objective is the infiltration and disruption of Operational Technology (OT) environments.

• Attack Vector and Persistence

  • Attackers specifically target Rockwell Automation PLCs that are directly exposed to the public internet.
  • Persistence is achieved through the installation of SSH backdoors within the compromised OT environment.
  • Unauthorized access is gained via the exploitation of internet-facing OT interfaces, bypassing traditional IT security boundaries.

• Technical Manipulation and Impact

  • Actors employ a technique to modify SCADA display data, creating a discrepancy between the actual physical state and the operator's view.
  • This deceptive telemetry prevents operators from detecting or responding to illicit changes in industrial processes.
  • Operational impact includes direct disruption of critical services and potential physical risk to infrastructure.

• Threat Actor Profile: MuddyWater

  • State-affiliated threat group linked to Iran's Ministry of Intelligence and Security (MOIS).
  • Specializes in targeted espionage and disruptive operations against strategic government and infrastructure targets.
  • Demonstrates advanced capabilities in manipulating specific industrial protocols and OT hardware.

• Defensive Actions and Mitigation

  • Immediate isolation of OT networks from the public internet to remove PLC exposure.
  • Implementation of strict access control lists (ACLs) and the disabling of unnecessary services, such as SSH, on industrial hardware.
  • Continuous monitoring for unauthorized modifications to SCADA configurations and anomalous traffic to PLC interfaces.