Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

Key Takeaways

• Iranian-affiliated APT actors are actively exploiting internet-facing Rockwell Automation/Allen-Bradley PLCs across US critical infrastructure.
• Attacks involve malicious interaction with project files and manipulation of HMI/SCADA displays, causing operational disruption.
• Threat actors utilize configuration software like Studio 5000 Logix Designer and deploy Dropbear SSH for remote access.
• Organizations must immediately disconnect PLCs from direct internet exposure and place physical mode switches into the RUN position.

Affected Systems

• Rockwell Automation/Allen-Bradley PLCs (CompactLogix, Micro850)
• Potentially Siemens S7 PLCs
• Internet-facing Operational Technology (OT) devices

Vulnerabilities (CVEs)

• CVE-2021-22681

Attack Chain

The threat actors identify internet-facing PLCs, specifically Rockwell Automation/Allen-Bradley devices, and establish connections using leased third-party infrastructure. They utilize native configuration software like Studio 5000 Logix Designer to access the devices and deploy Dropbear SSH for persistent remote access. Once connected, the attackers extract and maliciously interact with project files (.ACD files) and manipulate data on HMI and SCADA displays, resulting in operational disruption.

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

The advisory provides STIX XML and JSON files containing IOCs (IP addresses) for network defense, but does not include specific detection engineering rules like YARA or Sigma.

Detection Engineering Assessment

EDR Visibility: Low — PLCs and OT devices typically do not support standard EDR agents; visibility relies heavily on network monitoring and jump host telemetry. Network Visibility: High — The attack relies on inbound connections over specific OT ports and SSH from external IP addresses, which are highly visible in network flow and firewall logs. Detection Difficulty: Moderate — Detecting external connections to OT ports is straightforward if logging is enabled, but distinguishing malicious configuration software traffic from legitimate engineering traffic requires deep packet inspection or strict access control lists.

Required Log Sources

• Firewall logs
• VPN/Gateway logs
• Network flow logs
• Asset management system logs

Hunting Hypotheses

Hypothesis	Telemetry	ATT&CK Stage	FP Risk
Look for inbound network connections from external or unauthorized IP addresses to internal OT assets over ports 44818, 2222, 102, 502, or 22.	Firewall logs, NetFlow	Initial Access	Low
Identify unexpected SSH (port 22) traffic originating from or destined to PLC devices, which may indicate Dropbear SSH deployment.	Network traffic analysis	Command and Control	Medium
Monitor for unauthorized changes to PLC project files (.ACD) or unexpected device configuration modifications detected by asset management systems.	Asset management logs, OT monitoring tools	Impact	Medium

Control Gaps

• Direct internet exposure of OT devices
• Lack of MFA on remote access gateways
• Physical mode switches left in 'Remote' or 'Program' mode instead of 'Run'

Key Behavioral Indicators

• Traffic on ports 44818, 2222, 102, 502 from overseas hosting providers
• Presence of Dropbear SSH on OT endpoints
• Unexpected interactions with .ACD project files

False Positive Assessment

• Low

Recommendations

Immediate Mitigation

• Disconnect PLCs from the public-facing internet immediately.
• Place the physical mode switch on Rockwell Automation controllers into the 'Run' position.
• Query network logs for the provided malicious IP addresses.

Infrastructure Hardening

• Implement a secure gateway, firewall, or VPN to broker all remote connections to OT networks.
• Configure external and internal firewalls to block traffic using common OT ports (44818, 2222, 102, 502) from unauthorized segments.
• Disable unused services such as Telnet, FTP, RDP, and VNC on OT devices.

User Protection

• Implement multifactor authentication (MFA) for all remote access to the OT network.
• Create and test offline backups of PLC logic and configurations.

Security Awareness

• Ensure OT engineers understand the risks of leaving physical mode switches in 'Program' or 'Remote' positions.
• Review Rockwell Automation's security guidelines and apply necessary software patches during established downtime windows.

MITRE ATT&CK Mapping

• T0883 - Internet Accessible Device
• T1565 - Data Manipulation
• T0885 - Commonly Used Port
• T1219 - Remote Access Software

Additional IOCs

• Other:
  • Port 44818 - Commonly targeted OT port for inbound malicious traffic
  • Port 2222 - Commonly targeted OT port for inbound malicious traffic
  • Port 102 - Commonly targeted OT port for inbound malicious traffic
  • Port 502 - Commonly targeted OT port for inbound malicious traffic
  • Port 22 - Targeted for Dropbear SSH remote access