CISA and FBI Issue Urgent Warning on Third-Party ICS Risks Following Surge in Critical Infrastructure Attacks

Executive Summary

On September 24, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a joint advisory highlighting the escalating risks posed by third-party access to Industrial Control Systems (ICS). This warning comes amidst a year of unprecedented disruption to global critical infrastructure, including recent sabotage attempts on the German power grid and ongoing campaigns targeting water and energy utilities in the US and Europe.

Threat Analysis

The threat landscape for 2026 has shifted toward the exploitation of IT/OT convergence. Threat actors are increasingly leveraging third-party vendors—who often maintain persistent remote access to OT environments for maintenance—as a primary vector for lateral movement. Recent intelligence indicates that nation-state actors are specifically targeting these supply chain conduits to bypass perimeter defenses, aiming to maximize operational disruption rather than simple data exfiltration.

Technical Details

The advisory emphasizes that attackers are exploiting weak remote access controls, such as unmanaged VPNs and lack of multi-factor authentication (MFA) on jump servers. Once inside the enterprise IT network, adversaries utilize living-off-the-land (LotL) techniques to pivot into the OT environment. The use of compromised credentials from third-party service providers allows attackers to interact directly with Programmable Logic Controllers (PLCs) and Human-Machine Interfaces (HMIs). Recent incidents have shown that attackers are specifically targeting protocols like Modbus and Ethernet/IP to manipulate process-water treatment systems and power turbine controls.

Attribution Assessment

While the current advisory focuses on systemic vulnerabilities, it follows a series of high-profile attacks throughout 2026 attributed to groups such as Sandworm and various Iran-aligned actors. These groups have demonstrated a sophisticated understanding of OT protocols, often conducting reconnaissance for months before executing disruptive payloads. The persistence of these actors suggests a strategic intent to maintain a 'pre-positioned' presence within Western critical infrastructure.

Implications

The failure to secure third-party access points poses a catastrophic risk to public safety and economic stability. With energy operators like E.ON reporting a significant increase in both physical and cyber sabotage, the industry is facing a 'new normal' where the attack surface is effectively as large as the entire vendor ecosystem. The potential for business interruption, as highlighted by recent risk assessments, could reach into the hundreds of billions of dollars if systemic vulnerabilities remain unpatched.

Recommendations

1. Implement strict 'Least Privilege' access models for all third-party vendors, ensuring access is granted only on a just-in-time basis.
2. Enforce robust MFA for all remote access connections to OT environments, regardless of the vendor's internal security posture.
3. Conduct comprehensive audits of all internet-facing PLCs and OT assets to identify and remediate exposed interfaces.
4. Enhance network segmentation to ensure that a compromise in the IT environment cannot automatically lead to unauthorized control of critical OT processes.