The Minnesota attackers may hold a better backup of your plant than you do
Summary
More than 30 Minnesota community water systems experienced coordinated cyberattacks targeting their operational technology, leading to loss of remote control or intentional disconnection. The attacks potentially exploited a shared weakness in Rockwell Automation MicroLogix 1400 controllers, and attackers may have exfiltrated control logic project files, leaving some utilities without a current backup.
IFF Assessment
The article details a coordinated cyberattack on critical infrastructure, highlighting defender vulnerabilities and the potential for attackers to possess crucial operational data, which is bad news for defenders.
Defender Context
This incident underscores the critical need for robust security in operational technology (OT) environments, especially for smaller utilities that may lack comprehensive backup and recovery capabilities. Defenders must prioritize asset inventory, especially for internet-facing or remotely accessible OT devices, and understand their supply chain risks, including those posed by system integrators.