CISA is urging water facilities in the critical infrastructure sector to change the default passwords on their Unitronics devices and disconnect them from the internet after a water treatment facility in Pennsylvania was hit by a cyberattack.

Iranian threat actors are utilizing a new malware named IOCONTROL to compromise Internet of Things (IoT) devices and OT/SCADA systems used by critical infrastructure in Israel and the United States.

The US government slaps sanctions against six Iranian government officials linked to cyberattacks against Israeli PLC vendor Unitronics.

Municipal Water Authority of Aliquippa in Pennsylvania confirms that hackers took control of a booster station, but says no risk to drinking water or water supply.

The incident appears to be the latest perpetrated by the Cyber Av3ngers group targeting the Israel-made Unitronics tool.

"[O]ur regional teams are conducting notification for those organizations that are using these devices to the internet so that they can take action before an intrusion occurs,” a CISA official said.

An incident in Pennsylvania motivated the federal government to alert companies about ways hackers can break into Unitronics programmable logic controllers (PLCs).

Iranian-backed hacktivist group Cyber Av3ngers exploited Unitronics PLCs to target the Municipal Water Authority of Aliquippa in Western Pennsylvania.

The incident appears to be the latest perpetrated by the Cyber Av3ngers group targeting the Israel-made Unitronics tool.

U.S. and Israeli authorities say a small western Pennsylvania water authority was just one of multiple organizations breached by Iran-affiliated hackers who targeted a specific industrial control devi...

An incident in Pennsylvania motivated the federal government to alert companies about ways hackers can break into Unitronics programmable logic controllers (PLCs).

As Trump threatens Iranian infrastructure, the US government warns that Iran has carried out its own digital attacks against US critical infrastructure.

Exploitation of Unitronics programmable logic controllers

Unitronics has addressed critical vulnerabilities in its UniStream integrated PLC/HMI products, following cyberattacks on water treatment facilities. These vulnerabilities could allow attackers to bypass security mechanisms or execute remote code. Affected issues include improper authentication, path traversal, sensitive information exposure, and OS command injection, with CVE scores ranging from 8.8 to 10.0. Users are advised to update their UniStream UniLogic software to version 1.35.227 or newer and UniStream OS to version 1.35.47 or later to mitigate these risks.

The Unitronics Vision Series, specifically its VisiLogic Software, is susceptible to high-risk remote attacks (CVE-2023-6448, CVSS v3 score of 9.8) due to default administrative passwords in versions prior to 9.9.00, potentially allowing attackers administrative control, particularly impacting critical water and wastewater infrastructure.

The incident appears to be the latest perpetrated by the Cyber Av3ngers group targeting the Israel-made Unitronics tool.

"[O]ur regional teams are conducting notification for those organizations that are using these devices to the internet so that they can take action before an intrusion occurs,” a CISA official said.