Iranian Hackers Disable Safety Alarms in US Industrial Control Systems
Iranian threat actors have been actively compromising internet-exposed industrial controllers in the United States, altering mechanisms responsible for alarms and safety shutdowns in critical infrastructure environments.
The attacks have affected government organizations and operators in the water, sanitation, and energy sectors. Activity has been observed at least since March 2026 and has already caused operational interruptions and financial losses for some victims.
Attackers search for equipment with insecure remote access, weak credentials, or default configurations. Targeted devices include Rockwell CompactLogix and Micro850 controllers, Schneider BMX P34 and Modicon M340 PLCs, as well as Siemens S7-1200 models.
No evidence indicates the use of previously unknown vulnerabilities. Instead, operators leverage rented infrastructure abroad and legitimate industrial programming software to connect to target environments.
Once inside, the actors download PLC projects, modify the control logic, and upload the altered files back to the devices. In one documented incident, the malicious project kept part of the process running while adding instructions that allowed operations to exceed safe limits.
Attackers also modified data presented on HMI interfaces and SCADA systems. The techniques closely resemble earlier campaigns associated with the CyberAv3ngers group, which is linked to Iran’s Islamic Revolutionary Guard Corps, although direct attribution has not been confirmed.
Related articles
Russian-Aligned Gorbag Group Exploits WinRAR CVE-2025-8088 to Steal Credentials from Ukrainian Government Bodies
ESET has published a detailed report on the Gorbag threat group, a Russia-aligned actor active since at least February 2025, that has adopted the WinRAR path traversal vulnerability CVE-2025-8088 to deliver the BeautyStealer password stealer against Ukrainian public sector targets. The flaw, fixed in WinRAR 7.13, allows attackers to escape the chosen extraction folder and write files to arbitrary locations using Windows alternate data streams. Upon opening the malicious RAR archive, victims see a decoy PDF while a Windows startup shortcut and PowerShell loader are silently installed to maintain persistence. BeautyStealer, written in C++, harvests saved passwords, cookies, and browsing data from Chrome, Edge, Opera, and Firefox, along with OpenVPN configurations, KeePass databases, Java key files, and Ukrainian electronic signature keys. The group previously relied on malicious Excel macros in 2025 before switching to RAR-based delivery that requires no user interaction beyond opening the archive. Stolen data is exfiltrated via the Telegram API or, from version 1.2 onward, to attacker-controlled servers. ESET links the operation to earlier activity tracked as GIFTEDCROOK and UAC-0226 by CERT-UA.
Positive Technologies Analyzes 140 Incidents: Web Applications Drive Half of Breaches, APT Groups Found in 49% of Cases
Positive Technologies' Incident Response team examined more than 140 full-cycle investigations and retrospective analyses conducted between Q4 2025 and Q3 2026. Web applications on the perimeter remained the leading initial access vector, accounting for 50.8% of incidents, with newly targeted services including Zimbra mail servers and TrueConf video-conferencing platforms. APT activity was detected in 49.3% of victim organizations, while supply-chain attacks through contractors and ViPNet networks still represented 14.9% of entries despite a decline from the previous year. Industry became the most affected sector at 22.5%, and median time to bring incidents under control after engagement stood at two days. Root causes continued to center on outdated software, missing multi-factor authentication, and poor network segmentation. Three previously unknown APT groups—APT10051, Stingy Basilisk, and Chewbacca—were identified during the investigations.
Peskov Rejects Claims of Russian Involvement in European Refrigeration System Attacks
Kremlin spokesman Dmitry Peskov has dismissed accusations that Russian-linked cyber groups were behind recent attacks on industrial refrigeration equipment across nine European countries. The incidents, which occurred in early November, involved unauthorized changes to temperature settings on internet-connected cooling systems, with some units pushed to +50 °C. Similar attacks had already been reported in France during October, affecting meat producers and other facilities that rely on precise climate control. Peskov described the allegations as lacking any evidence and part of a recurring pattern of unsubstantiated claims directed at Russia by European nations. The targeted systems are typically connected online for remote maintenance and fault alerts, a feature that becomes a liability when external actors gain access. No group has claimed responsibility for the October or November operations, leaving attribution unconfirmed. The events highlight risks associated with exposing industrial control equipment directly to the internet without adequate segmentation or authentication controls.
North Korean Hacker Groups: Lazarus, Kimsuky, Andariel and Financial Clusters Behind Billions in Thefts
North Korean state-sponsored hacking operations linked to the Reconnaissance General Bureau and other agencies involve dozens of clusters conducting cyber espionage, technology theft, and large-scale financial crimes. Groups such as Lazarus, Kimsuky, Andariel, BlueNoroff, and APT38 have been tied to the 2014 Sony Pictures breach, the 2016 Bangladesh Bank heist, WannaCry, and recent multi-billion-dollar cryptocurrency thefts from Bybit and Binance. Specialized teams focus on fake job offers to infiltrate defense contractors, supply-chain attacks on developers, and ransomware operations that fund further espionage. Researchers from Microsoft, CrowdStrike, Google, and Mandiant track overlapping clusters using names like Diamond Sleet, Labyrinth Chollima, TraderTraitor, and UNC2970, noting frequent infrastructure sharing and evolving tactics. The activity spans political intelligence collection, defense technology theft, and crypto wallet compromises, with some clusters creating fictitious IT workers to gain remote access to foreign companies.