❌

Normal view

Received — 7 September 2026 ⏭

US Puts $10 Million Bounty on Alleged Iranian Cyber Chief

✇Cybersecurity News and Magazine
By: Samiksha Jain
7 September 2026 at 01:51

$10 Million Reward for Amir Yaryab

The U.S. State Department has posted a $10 million reward for Amir Yaryab, a senior Iranian official accused of leading the Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) Cyber Operations Command and directing multiple hacking groups targeting critical infrastructure across the United States, Europe and the Middle East. According to the Rewards for Justice program, Yaryab allegedly oversees cyber operations conducted by IRGC-CEC-affiliated groups including CyberAv3ngers, Dadeh Afzar Arman (DAA) and Mehrsam Andisheh Saz Nik (MASN). U.S. officials accuse these groups of using malware and conducting cyber and cyber-enabled information operations against civilian infrastructure worldwide.

$10 Million Reward for Amir Yaryab

The $10 million reward for Amir Yaryab seeks information leading to his identification or location. The offer applies to individuals acting at the direction or under the control of a foreign government who participate in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act. [caption id="attachment_113961" align="aligncenter" width="600"]$10 million reward for Amir Yaryab Image Source: https://rewardsforjustice.net/[/caption] Yaryab is also accused of directing Shahid Hemmat and Shahid Shushtari, two groups linked to cyberattacks against U.S. organizations. The sectors allegedly targeted include defense, news, shipping, travel, energy, financial services and telecommunications. The six Iranian officials named in the advisory are linked to Iran's Islamic Revolutionary Guard Corps and its Cyber-Electronic Command.

Iranian Cyberattacks Target PLCs

The allegations also involve attacks against programmable logic controllers (PLCs), highlighting concerns around Iranian cyberattacks targeting industrial systems rather than focusing only on data theft. U.S. officials said Iranian-linked hackers compromised industrial control systems, specifically targeting the Vision series of PLCs manufactured by Israel-based Unitronics. These devices are used across water and wastewater, energy, food and beverage, manufacturing and healthcare sectors. The attackers exploited default credentials on the devices and left anti-Israel messages. Some of the compromises reportedly rendered the PLCs inoperative. The CyberAv3ngers group, which is linked to the IRGC-CEC, claimed responsibility for attacks against Unitronics Vision PLCs in October 2023. Beginning in November 2023, the group compromised default credentials in PLCs across the United States and left messages on the devices' digital screens.

CyberAv3ngers Attacks Critical Infrastructure

CyberAv3ngers has also claimed responsibility for attacks affecting other infrastructure. In October 2023, the group claimed it had breached ORPAK Systems, a provider of gas station solutions in Israel. The group said it had obtained the company's database and intended to publish it through its Telegram channel. The attack was reported to have disconnected 200 gasoline pumps from the system in the occupied Palestinian territories. In December 2023, CyberAv3ngers also claimed to possess and sell 1TB of data allegedly linked to Israel's electricity infrastructure. The group advertised the dataset for 5 Bitcoin, with an initial 100GB portion also offered at the same price.

U.S. Agencies Warn of PLC Cyberattacks

Concerns over critical infrastructure attacks involving PLCs continued into 2026. A joint advisory issued on April 7 by the FBI, CISA, NSA and other agencies warned that Iran-linked threat actors were actively exploiting internet-facing PLCs. The advisory said several organizations had experienced operational disruptions and financial losses after attackers interfered with industrial processes. The developments come amid broader U.S. actions against Iranian-linked cyber activity. The Justice Department accused Iran-connected hackers of breaching employee email accounts associated with the Department of Labor, the Federal Energy Regulatory Commission and multiple United Nations organizations. The Treasury Department also sanctioned Iranian nationals over cyberattacks targeting critical infrastructure. The State Department's reward offer places Amir Yaryab and the alleged activities of IRGC-CEC-linked groups at the center of the U.S. effort to identify individuals responsible for malicious cyber activity targeting critical infrastructure.
Received — 3 September 2026 ⏭

CISA, FBI Urge Clearer Communication During Major Outages

✇Cybersecurity News and Magazine
By: Samiksha Jain
3 September 2026 at 01:37

outage communications

The CISA and FBI, along with cybersecurity agencies from Australia, Canada, New Zealand and the U.K., have released new guidance on outage communications for service providers dealing with major IT and OT outages. The guide calls for prompt, factual and audience-specific communication during disruptions caused by malicious cyber activity or non-malicious events.

Titled “Communicating Under Pressure: Best Practices for Service Providers,” the guidance says effective communication is critical to limiting operational impact when IT and OT outages affect customers, network defenders, critical infrastructure owners and operators, and the public. It recommends that organizations clearly communicate what is known, what remains unknown and what is still under investigation, while providing frequent updates as circumstances change.

Outage Communications Should Start With Facts

The agencies recommend that service providers establish an outage communications plan before an incident occurs. The plan should define incident thresholds, escalation paths, target audiences and procedures for status pages, customer and partner notices, and regulatory communications. Organizations are also advised to establish cross-functional incident teams involving engineering and operations, communications, legal, risk and compliance, and customer support.

The guidance calls for clearly defined roles, including an incident lead, communications lead and spokesperson. It also recommends parallel workstreams so technical teams can focus on diagnosing and remediating the root cause while communications teams manage external messaging and leadership handles strategy and regulatory requirements.

For organizations responding to cyber incidents, the guidance places particular emphasis on balancing transparency with operational security. If malicious activity is suspected or confirmed, external communications should not compromise investigations, containment efforts or other response activities. Organizations are also advised against making premature conclusions when the root cause remains under investigation.

Service Providers Urged to Tailor Messages

The guidance recommends segmenting communications for technical teams, executives and the public. Audiences can include enterprise IT teams and security operations centers, employees and customers, government partners and regulators, critical infrastructure owners and operators, as well as the media and general public.

During an outage, organizations should lead with a concise summary covering affected systems, user impact, scope and the known cause without speculation. The agencies also advise against vague descriptions such as “service degradation” and recommend messaging that can be understood quickly during high-pressure situations.

Transparency is another central principle. Service providers are advised to state what they know and do not know, use a single source of truth such as a status page, and focus communications on actionable guidance rather than reputation management. Customers should be told what actions they need to take or clearly informed when no action is required.

The guidance also calls for continuous, time-stamped updates that show the incident timeline, actions taken, and recovery milestones. Organizations should maintain a single status page and align external messaging with legal, contractual and sector-specific reporting obligations.

Agencies ultimately frame effective outage communications around five principles: immediate acknowledgement, technical and actionable information, transparency, accountability, and continuous updates. For service providers, the guidance positions communication as an important part of incident response, alongside technical remediation and recovery.

Received — 31 July 2026 ⏭

FBI Warns of PLC Cyberattacks Disrupting Water Utilities Across Seven States

✇Cybersecurity News and Magazine
By: Samiksha Jain
31 July 2026 at 04:17

PLC cyberattacks

The PLC cyberattacks targeting the Water and Wastewater Sector have prompted a joint warning from the Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA), after multiple cyber incidents disrupted water operations across the United States. Since July 27, 2026, utility companies in at least seven states have reported attacks involving internet-facing PLCs, with some incidents resulting in degraded operations after threat actors altered device configurations.

According to the Public Service Announcement (PSA), malicious cyber actors targeted Programmable Logic Controllers manufactured by Rockwell Automation, specifically the Allen-Bradley MicroLogix 1100 and 1400 series. The agencies warned that while the observed activity involved these devices, organizations using PLCs from other vendors should also review their security posture.

PLC Cyberattacks Disrupt Water Operations

The FBI said attackers gained remote access to exposed PLCs connected directly to the internet and modified device settings, including IP addresses and passwords. These unauthorized changes caused operators to lose monitoring and control capabilities over affected systems.

In some reported cases, organizations also discovered modified PLC project files after identifying discrepancies in ladder logic across multiple sites. The agencies noted that similar network configurations deployed by third-party providers across different customers could enable threat actors to compromise multiple organizations using the same vulnerable setup.

The operational impact varied depending on how the compromised controller was being used. Systems relying on PLCs for equipment control experienced more significant disruption than those using the devices only for monitoring.

Reported Operational Impact

The FBI stated that affected organizations experienced operational disruptions, including pressure loss and flooding.

The PSA warned that reduced pressure within water systems could potentially allow untreated groundwater to enter water pipelines. The severity of the disruption depended on several factors, including whether the PLC controlled equipment or only monitored it, the specific hardware model involved, and whether operators could quickly switch affected systems to manual operation.

The FBI and EPA said they continue working with impacted organizations while encouraging other critical infrastructure operators to strengthen protections against similar attacks.

FBI and EPA Recommend Immediate Security Measures

To reduce the risk of compromise, the agencies urged organizations to disconnect internet-facing PLCs from direct public internet access and instead use secure gateways and firewalls for remote connectivity.

The advisory also recommends securing cellular modems with strong authentication, enabling logging to detect suspicious activity, and implementing isolated network architectures such as private Access Point Names (APNs), Software-Defined Wide Area Networks (SD-WAN), Zero Trust Network Access (ZTNA), or site-to-site Virtual Private Networks (VPNs).

Organizations are advised to use complex, unique passwords for PLC devices and strictly limit communications through firewall rules or access control lists (ACLs) so only authorized control system devices can communicate with PLCs.

Additional recommendations include placing hardware and software key switches in run mode to prevent unauthorized configuration changes, validating project files before returning devices to operation, reviewing PLC logic for unauthorized modifications, verifying backups before restoration, and examining connected devices for signs of lateral movement.

The agencies also encouraged operators to maintain the ability to manually operate Operational Technology (OT) systems, routinely test disaster recovery procedures, and develop replacement plans for end-of-life hardware that no longer receives security updates.

Incident Reporting Encouraged

Organizations experiencing similar PLC cyberattacks or OT security incidents are encouraged to report them to their local FBI field office and submit a complaint through the Internet Crime Complaint Center (IC3).

The advisory also asks affected organizations to provide technical details, including PLC model numbers, serial numbers, IP addresses, and any unusual network activity connected to programmable controllers. For incidents involving Rockwell Automation products, organizations are advised to contact the company's Product Security Incident Response Team.

The FBI, EPA, and partner agencies also referenced previously published guidance covering incident response, cybersecurity best practices for water systems, and secure connectivity principles for Operational Technology (OT) environments.

Received — 18 June 2026 ⏭
❌