U.S. government sanctions Iranian officials over Pennsylvania water facility hack

The Iranian attack targeted a device manufactured by an Israeli company.

The U.S. Treasury Department on Friday announced sanctions against a half dozen Iranian government officials for their role in targeting devices at a Pennsylvania water utility in November 2023.

Working behind a flimsy persona — the “Cyber Av3ngers” — the Iranian Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) targeted programmable logic controllers manufactured by Unitronics, an Israeli company, including one at a water utility in Aliquippa, Pa., the Treasury Department said in its announcement.

The hackers posted a message to the screen of the device warning that “every equipment made in Israel is Cyber Av3ngers legal target.”

The incident did not cause any impact to the safety of the facility or drinking water in the area, authorities said at the time. Nevertheless, “unauthorized access to critical infrastructure systems can enable actions that harm the public and cause devastating humanitarian consequences,” the Treasury statement said.

Shortly after the incident, private industry analysts and others identified the attack as the work of the IRGC, given connections to previously identified hacking campaigns, the targeting, and other non-public information.

“The ultimate purpose of these hacks is to scare us and attack our trust in our own basic safety,” said John Hultquist, chief analyst with Google’s Mandiant Intelligence. “Unfortunately, they can be effective even when they fail to disrupt the services they target, which this actor knows.”

Hultquist said the water sector “has been under enormous pressure lately from Russian, Iranian, and Chinese cyber actors who recognize it as a vulnerable critical infrastructure. We have to take the threats to water seriously, but we can’t forget that the adversary’s primary goal is psychological.”

This particular operation was part of the long-running cyber tit-for-tat between Iran and Israel, an Israeli cybersecurity expert told CyberScoop at the time.

Friday’s sanctions targeted Hamid Reza Lashgarian, the head of the IRGC-CEC and a commander in the IRGC-Qods Force, and five other senior IRGC-CEC officials: Mahdi Lashgarian, Hamid Homayunfal, Milad Mansuri, Mohammad Bagher Shirinkar and Reza Mohammad Amin Saberian.

The Cyber Av3ngers persona remains active on Telegram and promised new attacks as recently as mid-January.

Treasury sanctions alleged Iranian hackers as part of ‘economic D-Day’

It’s a follow-up to an indictment the Justice Department unsealed last week against people affiliated with the Mabna Institute.

Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn

U.S. government charges three Iranians in Trump campaign hack 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure