Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a May 1, 2024 advisory, U.S., Canadian and U.K. agencies warned that pro-Russia hacktivists had attempted to access industrial control and operational technology systems in North America and Europe. Reported targets included water and wastewater, dams, energy, and food and agriculture. Intruders used exposed human-machine interfaces (HMIs), weak or default passwords, and outdated virtual network computing (VNC) software to alter equipment settings. Some incidents caused minor operational disruption, but most affected operators reportedly restored control promptly.
What the May 2024 warning described
The joint fact sheet from CISA and partner agencies described attempted compromises of industrial control systems (ICS) and operational technology (OT)—the computers and interfaces used to monitor and control physical processes. The reported activity focused on internet-accessible HMIs, which let operators view or change equipment settings, along with weak or factory-default credentials and outdated VNC software used for remote access. The reporting did not provide a campaign-specific incident total or technical indicators that would support identifying particular victims or systems. CISA and partners’ May 1, 2024 advisory; SecurityWeek’s contemporaneous account.
What intruders did—and what operators experienced
According to the advisory and contemporaneous reporting, intruders manipulated HMIs to push pumps and blower equipment beyond normal operating parameters, maximize set points, change settings, disable alarms, and change administrative passwords to prevent utility personnel from accessing the interface. Some victims reportedly experienced minor tank overflows. Most returned to manual control promptly and restored operations. A separate account said the government had not identified operational impact from the reported intrusions; that characterization should be read alongside the reports of nuisance-level effects, not as proof that no equipment or process was affected. CISA and partners’ advisory; SecurityWeek.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe activity was characterized as unsophisticated and generally limited in effect, but manipulating poorly secured OT can still create physical risks. In Texas, a reported water-system overflow was described as minor; local representatives said the public water system was not in danger. A separate claim of an attack on a French hydroelectric plant concerned a small mill, not a major hydroelectric facility. Threat-actor claims should therefore be distinguished from independently established details of an incident. SecurityWeek’s account of the incidents.
#1 Best Overall
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
Was this Sandworm?
The May 2024 joint advisory did not identify the operators or assign the activity to a named group. CISA executive assistant director for cybersecurity Eric Goldstein said the U.S. government was “not assessing a connection” between the activity and Sandworm at that time. Mandiant separately assessed that at least some hacktivist personas appeared linked to Sandworm, also known as APT44; SecurityWeek reported that this assessment concerned personas associated with CyberArmyofRussia_Reborn. That is a separate analysis, not an official government attribution and not proof that every incident had the same operator. SecurityWeek’s reporting on the attribution.
How this differs from earlier Russia-linked infrastructure cases
Earlier cases provide context, not evidence that the May 2024 activity was part of the same operation. The Australian Cyber Security Centre describes different Russian state-sponsored actors and past operations; it notes that BERSERK BEAR, also called Dragonfly, historically targeted critical infrastructure in Western Europe and North America. The FBI’s 2022 account of indictments describes alleged FSB Center 16 operations against energy companies and ICS/SCADA-related targets. It says the earlier Havex phase infected more than 17,000 unique devices between at least 2012 and 2014, and describes a 2017 intrusion into the business network of a Kansas nuclear power plant that the FBI said was not directly connected to ICS/SCADA devices. The FBI also cited about 500 companies worldwide in discussing a later historical energy-sector phase. These are historical figures and incidents—not counts or impact measures for the 2024 activity. Australian Cyber Security Centre advisory; FBI’s March 24, 2022 account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How operators can reduce exposure
The recommendations reported from the May 2024 advisory focus on basic access control and limiting exposure. They are system-level measures, not a prescription for a particular consumer product. Operators should adapt implementation to their system architecture, vendor requirements, and safety constraints.
- Harden HMIs: Review access controls and configuration for operator interfaces, including who can change settings and administer the system.
- Limit internet exposure: Avoid exposing OT systems directly to the public internet; review remote-access paths and restrict them to authorized use.
- Replace default and weak passwords: Use strong, unique credentials rather than factory defaults, and protect administrative access.
- Use multifactor authentication: Require MFA for access to OT networks where the system design and operational requirements support it.
Goldstein argued that factory-default passwords should be changed upon installation and called for MFA at least for external access. NSA Cybersecurity Directorate head Dave Luber urged administrators to implement the report’s mitigations, especially changing default passwords. Contemporaneous reporting on the advisory and agency comments.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
