CISA Warns of Hackers Attacking ICS/SCADA Systems in Oil and Natural Gas Companies

CISA along with the FBI, EPA, and Department of Energy, issued an urgent advisory, warning that cyber actors are actively targeting industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems within the U.S. oil and natural gas sector. 

Despite using elementary intrusion techniques, these attacks pose significant risks due to widespread poor cyber hygiene within critical infrastructure organizations.

“CISA is increasingly aware of unsophisticated cyber actor(s) targeting ICS/SCADA systems within U.S. critical Infrastructure sectors (Oil and Natural Gas), specifically in Energy and Transportation Systems,” the cybersecurity agency noted in its alert. 

Officials believe these threat actors are likely hacktivist groups or individuals claiming to be hacktivists who have been targeting internet-exposed OT systems since at least 2022.

According to the advisory, these actors employ basic but effective methods including exploiting default credentials, conducting brute force attacks, and targeting misconfigured remote access points. 

The attackers use “simple, repeatable, and scalable tool sets available to anyone with an internet browser” to identify vulnerable systems through search engine tools that scan for open ports on public IP ranges.

Security experts warn that while these intrusion techniques may be rudimentary, the consequences can be severe-ranging from system defacement and configuration changes to operational disruptions and, in worst-case scenarios, physical damage to critical infrastructure components. 

Industrial cybersecurity specialists have repeatedly cautioned that even unsophisticated attacks could have significant impacts on essential services.

Key Mitigations Against Cyber Threats

The authoring organizations have outlined five critical mitigations that asset owners and operators should implement immediately: 

• Removing OT connections from the public internet.
• Changing default passwords to strong.
• Unique alternatives.
• Securing remote access through private networks and phishing-resistant multi factor authentication (MFA).
• Segmenting IT and OT networks using demilitarized zones (DMZs).
• Maintaining capability for manual operations during cyber incidents.

“The targeted systems use default or easily guessable passwords. Changing default passwords is especially important for public-facing internet devices that have the capability to control OT systems or processes [CPG 2.A][CPG 2.B][CPG 2.C],” the advisory emphasizes.

Critical infrastructure organizations are also strongly encouraged to review their relationships with third-party service providers, as misconfigurations are frequently introduced during standard operations, by system integrators, or as part of default product configurations.

This advisory comes amidst increasing concerns about critical infrastructure vulnerabilities. 

Just weeks earlier, on April 22, 2025, CISA released five urgent advisories highlighting critical vulnerabilities in widely-used Industrial Control Systems from major manufacturers including Siemens, ABB, and Schneider Electric.

The alert concludes by directing organizations to CISA’s comprehensive resources, including guidance on identifying internet-exposed devices, implementing strong passwords, deploying phishing-resistant MFA, and establishing proper network segmentation.

Vulnerability Attack Simulation on How Hackers Rapidly Probe Websites for Entry Points – Free Webinar