Cyber Av3ngers

Scanning and Identification: The group scans the internet (likely using tools like Shodan) to identify publicly accessible Unitronics PLCs. These devices are often exposed due to misconfiguration or a lack of awareness of the security risks.

Default Credential Exploitation: A key tactic is attempting to log in using default credentials, which are readily available in online Unitronics manuals (e.g., the default password "1111"). This highlights a fundamental security weakness in many OT deployments. It's crucial to have a patch management strategy to mitigate such risks.

Port Exploitation: The attackers target the default TCP port (20256) often used by Unitronics devices.

Defacement: Once access is gained, Cyber Av3ngers typically alters the PLC's menu page or HMI screen, displaying anti-Israel messages and claiming responsibility for the attack. This defacement serves both a propaganda purpose and disrupts operations.

Ladder Logic Manipulation: They have developed custom ladder logic files to download for each of these device types. They erase the original ladder logic files and upload their own (with no inputs or outputs). They also rename compromised devices, set the software version of their ladder logic files to older versions, disable upload and download functions, enable password protection for upload settings, and change the default port number for remote communication.

Potential Further Access: While defacement is the most visible outcome, CISA warns that gaining access to the PLC provides a potential pathway for deeper access into the compromised network, potentially leading to more severe cyber-physical effects. The importance of security logging and monitoring cannot be overstated.

Possible Ransomware Connection: Some reports suggest a possible association with "Crucio" ransomware, although these claims are unverified and considered questionable by some security researchers.

Israeli Railway Systems (July 2023): The group claimed to have disrupted operations at 28 Israeli railway stations by targeting 150 servers. These claims are disputed.

U.S. Municipal Water Authority (November 2023): This confirmed attack involved the compromise of a Unitronics PLC at a water pumping station in Aliquippa, Pennsylvania. The attackers defaced the HMI and disrupted operations, forcing the authority to switch to manual control.

Multiple U.S. WWS Facilities (November 2023 - January 2024): CISA reported that Cyber Av3ngers targeted U.S.-based Unitronics PLC devices used in multiple critical infrastructure industries, including the WWS Sector, likely in four separate waves of cyberattacks. The actors compromised at least 75 devices, including at least 34 in the WWS Sector in the United States.

Other U.S. Targets: Besides the water authority, other confirmed targets include a brewery in Pittsburgh and an aquarium.

Claimed Attacks on Israeli Water Treatment Stations The group claimed in October 2023 to have infiltrated 10 water treatment stations in Israel. These claims have been questioned.

Targeting in the UK: The group has also been observed targeting PLCs in the United Kingdom.

Ransomware association: There's a possible, albeit unverified, connection with the "Crucio" ransomware.

Change Default Passwords Immediately: This is the most critical and easily implemented step. Validate that the default password "1111" (or any other default) is not in use. Passwordless Authentication is increasingly important.

Implement Multi-Factor Authentication (MFA): Require MFA for all remote access to the OT network, including access to PLCs.

Isolate PLCs from the Public Internet: Disconnect PLCs from the open internet whenever possible. If remote access is necessary, use a secure VPN and firewall to restrict access.

Regular Backups: Back up PLC logic and configurations regularly to enable quick recovery in case of an attack. Implement the 3-2-1 backup strategy (3 copies of data, 2 different media, 1 offsite).

Change Default Port: Change the default TCP port (20256) used by Unitronics devices, if the device allows.

Update Firmware: Keep PLC and HMI firmware updated to the latest version to patch known vulnerabilities. Upgrade to VisiLogic software, which mandates password changes.

IP Allow listing: Configure the PLC to only accept connections from authorized IP addresses.

Physical security: Many PLCs have physical security keys to lock and unlock.

Network Segmentation: Implement strong network segmentation between the IT and OT networks to limit the impact of a potential breach.

Vulnerability Management: Regularly scan for and patch vulnerabilities in OT systems. Have a vulnerability management plan.

Intrusion Detection and Monitoring: Implement OT-specific intrusion detection systems (IDS) and monitor network traffic for anomalous activity.

Incident Response Plan: Develop and regularly test an OT-specific incident response plan.

Security Awareness Training: Train personnel on the risks of phishing and social engineering, and the importance of strong passwords.

Secure Remote Access: Implement secure remote access solutions with MFA and strong access controls.

Vendor Security: Assess the security practices of OT vendors and ensure they are following secure development practices. Supply chain attacks are a significant threat.

Security control testing: Continuous security control testing using a framework such as MITRE ATT&CK.

Supply Chain Security: Monitor vendors and suppliers for incidents and vulnerabilities.