Iran-Linked ICS Intrusions: Defending Water and Energy Control Systems Against Active Manipulation

A joint advisory from CISA, the FBI, the NSA, and the Department of Energy confirms that Iran-linked cyber actors have moved beyond reconnaissance. They are actively accessing—and modifying—internet-exposed control systems in the U.S. water and energy sectors. This is not a theoretical risk; adversaries are inside operational networks, altering settings in ways that could disrupt critical services.

For defenders, the urgency is absolute. The attack vector relies on a fundamental operational failure: the exposure of sensitive interfaces like Human-Machine Interfaces (HMIs) and Programmable Logic Controllers (PLCs) to the public internet. This post dissects the threat and provides the detection logic and hardening steps required to eject these actors and secure critical infrastructure.

Technical Analysis

Affected Assets: The advisory targets Unitronics and similar OT/ICS devices commonly used in Water and Wastewater Systems (WWS) and energy generation facilities. These systems often include integrated web servers for remote management.

The Attack Vector: Actors are scanning for and identifying internet-exposed OT devices (typically listening on ports 80/443 or proprietary protocol ports like TCP 20256 for Unitronics). Once identified, they leverage default credentials or weak passwords to gain access.

Post-Exploitation Activity: Unlike traditional espionage-focused APT activity, these actors are engaging in "Image Hijacking." They disable the local display on the HMI/PLC and overlay it with a graphic (often political messaging or slogans). While the visual overlay is the most obvious symptom, the act of rewriting the HMI interface implies the adversary has the privileges to manipulate the underlying logic or configuration—a capability that poses a severe physical risk.

Exploitation Status: CISA has confirmed active exploitation. This is a live campaign targeting critical infrastructure. There are no specific CVEs (2025/2026) listed as the primary vector in this advisory; the failure is configuration-based (exposure and weak authentication), making remediation immediate and non-patch-dependent.

Detection & Response

Detecting this activity requires visibility at the network perimeter and on the engineering workstations. You are looking for unauthorized external access to OT protocols and unexpected reconfiguration of PLC project files.

Sigma Rules

The following Sigma rules detect suspicious external network connections to common OT ports and potential process manipulation on engineering workstations.

---
title: Potential OT Internet Exposure - Inbound Connection on SCADA Ports
id: 8a2b3c4d-5e6f-4a5b-8c6d-7e8f9a0b1c2d
status: experimental
description: Detects inbound network connections to common SCADA/ICS ports from non-private IP ranges, indicating potential exposure to the public internet.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-247a
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.ics
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 80
      - 443
      - 20256
      - 502
      - 102
  filter_private:
    SourceIP|startswith:
      - '10.'
      - '192.168.'
      - '172.'
      - '127.'
  condition: selection and not filter_private
falsepositives:
  - Legitimate remote VPN traffic from known corporate blocks
level: high
---
title: Suspicious Engineering Workstation Process Execution
id: 9b3c4d5e-6f7a-5b6c-9d7e-8f9a0b1c2d3e
status: experimental
description: Detects execution of engineering software (e.g., Unitronics VisiLogic) spawning command shells, a potential sign of unauthorized manipulation or tooling misuse.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    Image|contains:
      - 'VisiLogic.exe'
      - 'UniApps.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative scripting by engineers
level: medium

KQL (Microsoft Sentinel / Defender)

This query hunts for external IP addresses connecting to high-risk OT/PLC ports within your environment.

DeviceNetworkEvents
| where RemotePort in (80, 443, 20256, 502, 102, 2404)
| where ActionType == "InboundConnectionAccepted"
// Filter out known internal RFC1918 space
| where not(ipv4_is_in_range(RemoteIP, "10.0.0.0/8")) 
| where not(ipv4_is_in_range(RemoteIP, "192.168.0.0/16")) 
| where not(ipv4_is_in_range(RemoteIP, "172.16.0.0/12"))
| summarize Count=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
| order by Count desc

Velociraptor VQL

Hunt for established network connections on ICS-relevant ports that indicate a device is communicating outside the local subnet.

-- Hunt for active OT protocol connections
SELECT Fqdn, Pid, Family, Address, RemoteAddress, RemotePort, State
FROM netstat()
WHERE RemotePort IN (80, 443, 20256, 502, 102)
  AND State = 'ESTABLISHED'
  AND NOT RemoteAddress =~ '^(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'

Remediation Script (Bash)

Use this script on Linux-based ICS gateways or servers to audit for listening services on dangerous ports that should not be exposed to the internet.

#!/bin/bash
# Audit for exposed OT/SCADA ports
# Requires root privileges for accurate results

echo "Auditing for listening services on common OT ports (80, 443, 20256, 502, 102)..."

# Check for listening sockets on target ports
netstat -tulpen | grep -E ':(80|443|20256|502|102)\s' > /tmp/ot_port_audit.log

if [ -s /tmp/ot_port_audit.log ]; then
    echo "[WARNING] Found listening services on critical ports:"
    cat /tmp/ot_port_audit.log
    echo ""
    echo "Action Required:"
    echo "1. Verify if these services must be internet-facing."
    echo "2. If not, block inbound traffic via firewall immediately."
    echo "3. Bind these services to internal management interfaces only."
else
    echo "[OK] No services listening on monitored OT ports."
fi

rm /tmp/ot_port_audit.log

Remediation

Immediate defensive actions are required to secure water and energy control systems against this active campaign.

1. Eliminate Internet Exposure:

   • Identify all control systems (PLCs, RTUs, HMIs) with public IP addresses.
   • Move these devices behind firewalls immediately. Remove port forwarding (DNAT) rules that expose OT protocols (e.g., TCP 20256, 502) to the internet.

2. Enforce Strong Authentication:

   • Change all default credentials on OT devices. Mandate complex, unique passwords for all administrative and operator accounts.
   • Implement Multi-Factor Authentication (MFA) for all remote access solutions (VPNs, Jump Hosts) used to reach the OT network.

3. Network Segmentation:

   • Ensure the OT network is strictly separated from the IT network via a Demilitarized Zone (DMZ) or an industrial DMZ (IDMZ). Monitor all traffic traversing these boundaries.

4. Audit Configuration Backups:

   • Compare current logic and configuration files against known-good "golden" backups. Look for unauthorized changes made during the intrusion window.

5. Vendor Advisory:

   • Review the latest guidance from CISA (AA24-247A) and device vendors (e.g., Unitronics) for specific hardening guides for your model.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub