Iran-linked cyberattack shut down a UK power plant

A suspected Iran-linked cyberattack shut down a small UK power plant around the time that a series of digital intrusions disrupted American water utilities across 12 states. A British government spokesperson confirmed the hack to The Register on Monday and told us that the security incident affected a small-scale energy generator." At no point was there a risk to the wider energy system," the spokesperson said, adding that the UK's energy system is highly resilient," and that the government works closely with the energy sector to protect infrastructure." In a series of xeets about the cyberattack, UK Energy Minister Michael Shanks said that his department briefed energy CEOs after the incident and shared further advice with companies on the steps they should take to stay secure." Government officials did not disclose which power station shut down, and the UK has not formally attributed the cyberattack to Iran - or any other government or hacking group. The Telegraph, which first reported the news, said that the incident shut down the power plant for four days in what is believed to be the first disruptive Iranian cyberattack of its kind in the UK. In late July, suspected Iranian cyber operatives disrupted more than 30 water facilities in Minnesota, with similar intrusions subsequently reported across at least 11 other US states. While neither state nor federal officials have attributed these hacks to Iran, private-sector threat analysts have told The Register that Iran is almost certainly" behind these breaches, which are a direct response to the ongoing Middle East conflict. While these earlier water-system intrusions didn't appear to have an AI assist - most or all of the American utility cyberattacks involved internet-connected programmable logic controllers (PLCs) - last week the feds warned that attackers are now using AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series PLCs at water, manufacturing, energy, and other critical facilities. This is not a theoretical risk - it is an active threat," the FBI and four other federal agencies warned. This appears to be a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs," Cynthia Kaiser, Halcyon Ransomware Research Center SVP and a former FBI cyber analyst, told The Register. Iran-affiliated actors and adversaries are actively targeting a wide swath of operational technology because these PLCs underpin essential health, safety, and critical infrastructure across society," Kaiser said. (R)