South Africa Among Highest Hit in Global Unitronics PLC Hack

In a significant cybersecurity incident, South African water and sewage control systems potentially faced a considerable threat due to a worldwide hack targeting Unitronics programmable logic controllers (PLCs). The Shadowserver Foundation, an international security monitoring group, has disclosed that South Africa ranks among those nations most affected by this recent cyberattack, placing the integrity of its critical infrastructure at risk.

The incident came to light following a warning advisory by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which highlighted that a state-sponsored Iranian hacking group, known as CyberAv3ngers, successfully exploited vulnerabilities in the said controllers. Specifically, the CyberAv3ngers have been associated with the Iranian Government's Islamic Revolutionary Guard Corps (IRGC), an entity labeled as a foreign terrorist organization by the United States in 2019. This breach has broad implications given the extensive use of these systems across various sectors, from energy to healthcare and food and beverage manufacturing.

CISA's advisory underscores the sophisticated capabilities of the CyberAv3ngers, categorizing them as an Advanced Persistent Threat (APT) group. Alarmingly, earlier alerts mentioned that a U.S. water facility was compromised through these very Unitronics PLCs, raising concerns over critical infrastructure security. The immediate response involved shutting down the system and switching to manual operations, ensuring that there was no known risk to public water safety.

Key to the breach was the exploitation of security weaknesses, such as the use of default passwords (which for Unitronics PLCs is alarmingly simple: "1111") and inadequate protective measures for systems that never should have been connected to the Internet in the first place. Urgent recommendations from CISA include the change of default passwords, implementation of multifactor authentication for remote access, and the physical separation of PLCs from direct Internet access, favoring instead secured channels like VPNs and firewalls.

In an endeavor to quantify the scale of the risk, Shadowserver conducted a scan and revealed a troubling global picture: at least 539 Unitronics PLC instances left publicly exposed. Among the countries indexed, Australia was the most impacted, with South Africa sharing the ranks with Brazil and the Netherlands. Realizing this vulnerability has sparked concern, as the precise application of these PLCs within South Africa remains undisclosed—a fact which, considering the potential consequences of such information being known to malevolent actors, might be more of a safeguard than a deficiency in transparency.

This cybersecurity breach has prompted no immediate public response from South African officials. MyBroadband, a local technology news outlet, sought comments from ministers and the Department of Water & Sanitation but to no avail, reflecting a concerning silence on an issue of national resilience.

As of now, organizations that rely on Unitronics PLCs must rigorously reassess their cybersecurity protocols to prevent further exploitation risks and protect the South African populace and its infrastructure from potential sabotage.