CISA advisory AA23-335A was first published on 1 December 2023 and last revised on 18 December 2024. It describes IRGC affiliated actors using the "CyberAv3ngers" persona to attack Unitronics Vision Series PLCs and HMIs, widely used in water and wastewater systems and other industries. Between November 2023 and January 2024 the actors compromised at least 75 US devices, including at least 34 in the water and wastewater sector.
They did not need an exploit. They logged into internet connected devices that had a default password or no password, using the default communication port. Safeguard does not operate water plants or controllers. This post turns the advisory into a checklist that suits any plant or product team.
What's affected
Unitronics Vision Series PLCs and HMIs. The advisory says that once inside, the actors replaced control logic, renamed devices, changed software versions, disabled upload and download functions, changed the port number and displayed a defacement message on HMI screens. It warns that such access could enable more serious effects on physical processes and equipment.
How to check if you're exposed
- Search your own address space for controllers and HMIs reachable from the internet. The advisory's first action is to "address operational technology connected insecurely to the internet."
- For each controller, test whether it accepts a default password or none: "Check PLCs for default or no passwords."
- Record each device's firmware and engineering software version. The advisory names VisiLogic 9.9.00 and updated Vision firmware as the immediate fix for Unitronics.
- Check whether you have a tested copy of each controller's logic and configuration.
What to do now
- Disconnect PLCs from the public internet.
- Replace default passwords with strong, unique ones.
- Implement multifactor authentication, and place a VPN, gateway or firewall in front of any remote access.
- Upgrade engineering workstations and device firmware as the vendor directs.
- "Create and test strong backups of the logic and configurations of PLCs to enable fast recovery," and keep cold standby or replacement hardware of similar models.
- Segment the network and periodically inventory internet accessible devices.
How this could have been avoided
Each step in the attack maps to a control the advisory lists. No internet exposure means no login prompt for strangers. A unique password per device means a scan of the default port finds nothing. Backups of logic mean replaced logic is restored rather than rebuilt. Segmentation limits what a compromised controller can reach.
Why it matters
Default credentials are a software supply chain problem too. A product that ships with the same password on every unit hands every customer the same weakness. If you make controllers, force a password change at first use. If you buy them, put credential checks in your acceptance test.
Software inventories help with the version question in step 3. Safeguard can generate and import SBOMs and scan them against known vulnerabilities with KEV status, which covers the engineering workstation software and any containers or dependencies around the plant.
Try it yourself
Take your list of controllers and engineering tools and run a vulnerability pass over their software versions.
Click through it at your own pace, or open it full screen.
Quick check
How did the actors get in, according to the advisory?
By logging into internet connected devices that had default or no passwords, using the default communication port.
What does CISA say to keep besides backups of PLC logic?
Cold standby or replacement hardware of similar models.
