CISA Urges Critical Infrastructure to Harden Defenses as Iran-Linked and AI Threats Grow

Iran-linked groups target operational technology

According to a joint advisory from U.S. government agencies, published in April and updated in July, advanced persistent threat (APT) groups affiliated with Iran's government have attacked U.S. water, energy and government facilities since the U.S. launched Operation Epic Fury against Iran in February. The advisory says the groups target internet-connected operational technology (OT) devices such as programmable logic controllers (PLCs).

The activity has had real effects. The advisory states that organizations from multiple U.S. critical infrastructure sectors "experienced disruptions through malicious interactions with PLC project files and the manipulation of data displayed on human-machine interface (HMI) and supervisory control and data acquisition (SCADA) displays." In a few cases, it adds, this caused operational disruption and financial loss.

The tactics, techniques and procedures match those of CyberAv3ngers, a group the U.S. government previously identified as operating under Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). Experts cited by Tenable have observed that many nation-state groups have shifted from stealthy espionage to destructive attacks meant to disrupt victims' operations.

The advisory recommends that security teams install PLCs following manufacturers' guidelines, use secure gateways and firewalls to remove PLCs from direct internet exposure, and review system logs for indicators of compromise and suspicious traffic on ports used by OT devices.

AI adds pressure on converged IT and OT networks

Tenable says organizations that secure environments where IT and OT converge now also face AI-boosted attacks. According to the company, attackers are using AI to map converged networks at machine speed and to exploit legacy systems that have not been inventoried. They are also using AI to gain the specialized knowledge needed to breach complex industrial control systems.

Tenable points to asset visibility gaps as a central weakness. Many older OT systems are hard to inventory, which leaves them unmonitored and unpatched and creates hidden attack vectors.

CISA's guidance: hygiene basics and the three R's

CISA's Cybersecurity Awareness Month message this year, titled "Securing the Next 250," focuses on protecting U.S. critical infrastructure and ties in with the 250th anniversary of the country's founding. Tenable notes the campaign is in its 22nd year.

CISA stresses that adversaries generally look for the easiest way in, so a solid hygiene foundation matters in every sector. Its recommendations include:

• Train employees to recognize phishing and make it easy to report suspicious activity.
• Require strong passwords and adopt phishing-resistant multifactor authentication.
• Update software promptly, fix misconfigurations and patch the highest-risk vulnerabilities.
• Monitor and log system activity to spot attack attempts.
• Back up and encrypt data.
• Draft, regularly update and rehearse an incident response plan.
• Prepare to recover from disruptions, including workarounds that keep essential functions running.

To make these easier to remember, CISA promotes the three R's: reduce vulnerabilities, replace devices that vendors no longer support, and recover quickly to maintain operations. It points security teams to Binding Operational Directive BOD 26-04, "Prioritizing Security Updates Based on Risk," published in June, BOD 26-02, "Mitigating Risk From End-of-Support Edge Devices," published in February, and its CI Fortify initiative.

Joint principles for securing OT connectivity

Earlier this year CISA and the cybersecurity agencies of Australia, Canada, Germany, the Netherlands, New Zealand and the U.K. published joint guidance titled "Secure connectivity principles for operational technology." It says exposed and insecure OT connectivity is targeted by both opportunistic and highly capable actors, including state-sponsored actors going after critical national infrastructure networks.

The guide sets out eight principles: balance the risks and opportunities, limit the exposure of connectivity, centralize and standardize network connections, use standardized and secure protocols, harden the OT boundary, limit the impact of compromise, ensure all connectivity is logged and monitored, and establish an isolation plan. According to the document, strengthening security, including OT connections, can "raise the threshold necessary to cause physical harm, environmental impact, and disruption."

What it means for operators

The guidance points operators toward the basics: know what assets they have, remove direct internet exposure from OT devices, patch by risk, retire unsupported equipment and rehearse recovery. Tenable also notes that organizations can draw on support from agencies and groups such as the Center for Internet Security and the SANS Institute. With Iran-linked actors already having caused disruption and financial loss at some U.S. organizations, according to the joint advisory, the agencies' message is that foundational controls remain the first line of defense.