DROP IN THE BUCKET— The cyber front of the simmering war in the Middle East is now spilling into the West, and federal agencies are sounding the alarm on Iranian state-linked hackers hitting water facilities in the United States. A joint advisory issued Friday by the FBI, CISA, NSA, Environmental Protection Agency and the Israel National Cyber Directorate warns that the government-linked Cyber Av3ngers “are actively targeting and compromising” Israeli-made programmable logic controllers widely used in U.S. water and wastewater treatment facilities. An unnamed source told CNN that CISA held meetings with Congress on Thursday, telling staffers that computers at “less than 10” water facilities across the country had been breached. — Finding a deterrent: The question now lies in how the U.S. government could respond. The decades-long tactic of sanctioning Iran back to the Stone Age is unlikely to yield meaningful results, considering how its economy remains resilient and its cyber capabilities have only gotten to be more sophisticated (and emboldened). Because of the number of newly exposed vulnerabilities in the water sector Mark Montgomery, executive director of the influential CSC 2.0, suggests appropriate “cyber cost imposition actions” are necessary. That might involve blocking internet access for the hacking group — a similar tactic CYBERCOM pulled with the Internet Research Agency in 2018. “While the U.S. reserves the right to respond to cyber attacks with any type of weapon, in this case, given the limited impact of the IRGC cyber attacks, a cyber response is probably best warranted,” Montgomery shared. — Deal with it: Despite not causing significant harm, the attacks triggered a wave of concern from cyber leaders in the industry and on the Hill. That includes former CISA director Chris Krebs posting on X with the hashtag “#ImposeCosts that the government “needs to hold Iranian actors accountable” and House Homeland Security cyber subcommittee Chair Andrew Garbarino (R-N.Y.) urging “the Biden administration to hold these actors accountable.” “The United States cannot turn a blind eye to malign foreign actors who jeopardize the safety, security and well-being of Americans and our allies,” Garbarino said in a statement. — A more restrained view: The attacks amount to little more than public defacement, more symbolic than a prelude to a devastating disruption. James Lewis, a senior vice president at the Center for Strategic and International Studies and former diplomat, told MC that the recent attacks looked to be “pretty low budget hacks … against non-strategic targets.” Lewis argues that Iran’s primary motivation for the attacks is likely to send a message of defiance rather than inflict serious damage. “So not really a big deal,” he summed up. — Who are the attackers?: Shmuel Gihon, security research team leader at Israel-based Cyberint, told MC he’s been tracking Cyber Av3ngers since it emerged around September — and the group has been quite active since the start of the conflict between Israel and Hamas. It’s even been involved in targeting water facilities in Israel, including a recent breach of Mekorot, Israel’s national water company. While disruptions by the group have so far been limited in scope and tend to focus on leaking data, Gihon warns its link to other hacktivists is a serious problem. “Despite being a relatively unsophisticated and new group, they are very connected to other groups within the hacktivist community,” Gihon explained. “And that’s the main threat they pose — the potential recruitment of other, more sophisticated groups.”
| 
