{"id":51949,"date":"2022-07-05T09:28:21","date_gmt":"2022-07-05T01:28:21","guid":{"rendered":"https:\/\/version-2.com\/?p=51949"},"modified":"2022-08-22T14:11:08","modified_gmt":"2022-08-22T06:11:08","slug":"the-iran-steel-industry-cyber-attack-explained","status":"publish","type":"post","link":"https:\/\/version-2.com\/en\/2022\/07\/the-iran-steel-industry-cyber-attack-explained\/","title":{"rendered":"The Iran Steel Industry Cyber Attack Explained"},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\"\"<\/p>\n\n

A Change In The Air<\/h2>\n

Iran\u2019s steel Industry was hit by a hacktivist group calling themselves \u201dGoneshke Darande<\/a>\u201d [Predatory Sparrow] on June 27th, 2022. The attack focused specifically on three steel companies that are currently subject to international sanctions, Mobarakeh Steel Company, Hormozgan Steel Company, and Khuzestan Steel Industries. This blog will investigate the Khuzestan attack.<\/p>\n

<\/div>\n

At 3:08:22 pm local time, a compromised internal plant camera at Khuzestan shows the loss of control and within 12 minutes the camera captured catastrophic failure. In the video it appears that there is a disruption in the vacuum degassing stage of the ladle metallurgy process where the molten steel in the ladle is under vacuum to remove dissolved gasses entrained in the steel before it gets poured. This is problematic because remnants of even a few parts per million of hydrogen gas remaining in the pour causes massive defects and drastic loss of structural integrity. <\/p>\n

The attackers posted images <\/a>from the compromised ICS leading up to the event on their twitter account.<\/p>\n

\"Screenshot<\/p>\n

From this screenshot we can deduce that the Khuzestan Steel Factory was using a Siemens PCS7<\/a> Process Control System and based on the graphics it was most likely S7-400 controllers. Digging a little deeper into the OSINT (Open Source Intel) it appears that see that IRISA <\/span><\/a>International Systems Engineering & Automation Company worked on designing and implementing various portions of the steel factory.<\/p>\n

\"Industrial<\/p>\n

In my book Pentesting Industrial Control Systems<\/span><\/a> under section 2 \u2013 Understanding the Cracks Chapter 4 \u2013 Open Source Ninja, I elaborate on the fact that gaining insight to openly available data for a client\u2019s industry, process, employees, equipment, and technology is absolutely essential. Throughout the chapter I go on to caution companies and specifically blue teamers that monitor social media posts of employees and 3rd party vendors, as they might innocently and non-maliciously publish critical information related to your company\u2019s production environment. <\/p>\n

The silver lining of this cyber incident is that no one was hurt and it may open more discussions on industrial cyber security awareness.<\/p>\n

To learn more about how the SCADAfence Platform can protect your OT network request a demo<\/a> today.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t
\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

About Version 2 Digital<\/h3>

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.\n

\nThrough an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.<\/p><\/div><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t\n\t\t

\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

<\/p>\n

About SCADAfence<\/strong>
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT\/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world\u2019s most complex OT networks, including Europe\u2019s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"

A Change In The Air Iran\u2019s steel Industry was hit by a […]<\/p>","protected":false},"author":143524195,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[417,488,61],"tags":[418,489],"class_list":["post-51949","post","type-post","status-publish","format-standard","hentry","category-scadafence","category-488","category-press-release","tag-scadafence","tag-489"],"acf":[],"yoast_head":"\nThe Iran Steel Industry Cyber Attack Explained - Version 2<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"The Iran Steel Industry Cyber Attack Explained - Version 2\" \/>\n<meta property=\"og:description\" content=\"A Change In The Air Iran\u2019s steel Industry was hit by a […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained\" \/>\n<meta property=\"og:site_name\" content=\"Version 2\" \/>\n<meta property=\"article:published_time\" content=\"2022-07-05T01:28:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-08-22T06:11:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.scadafence.com\/hubfs\/IranBlog.png\" \/>\n<meta name=\"author\" content=\"version2hk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"version2hk\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/blog.scadafence.com\\\/the-iran-steel-industry-cyber-attack-explained#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2022\\\/07\\\/the-iran-steel-industry-cyber-attack-explained\\\/\"},\"author\":{\"name\":\"version2hk\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\"},\"headline\":\"The Iran Steel Industry Cyber Attack Explained\",\"datePublished\":\"2022-07-05T01:28:21+00:00\",\"dateModified\":\"2022-08-22T06:11:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/2022\\\/07\\\/the-iran-steel-industry-cyber-attack-explained\\\/\"},\"wordCount\":366,\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.scadafence.com\\\/the-iran-steel-industry-cyber-attack-explained#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.scadafence.com\\\/hubfs\\\/IranBlog.png\",\"keywords\":[\"SCADAfence\",\"2022\"],\"articleSection\":[\"SCADAfence\",\"2022\",\"Press Release\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/version-2.com\\\/2022\\\/07\\\/the-iran-steel-industry-cyber-attack-explained\\\/\",\"url\":\"https:\\\/\\\/blog.scadafence.com\\\/the-iran-steel-industry-cyber-attack-explained\",\"name\":\"The Iran Steel Industry Cyber Attack Explained - Version 2\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/blog.scadafence.com\\\/the-iran-steel-industry-cyber-attack-explained#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.scadafence.com\\\/the-iran-steel-industry-cyber-attack-explained#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.scadafence.com\\\/hubfs\\\/IranBlog.png\",\"datePublished\":\"2022-07-05T01:28:21+00:00\",\"dateModified\":\"2022-08-22T06:11:08+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/blog.scadafence.com\\\/the-iran-steel-industry-cyber-attack-explained#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/blog.scadafence.com\\\/the-iran-steel-industry-cyber-attack-explained\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blog.scadafence.com\\\/the-iran-steel-industry-cyber-attack-explained#primaryimage\",\"url\":\"https:\\\/\\\/blog.scadafence.com\\\/hubfs\\\/IranBlog.png\",\"contentUrl\":\"https:\\\/\\\/blog.scadafence.com\\\/hubfs\\\/IranBlog.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/blog.scadafence.com\\\/the-iran-steel-industry-cyber-attack-explained#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9801\",\"item\":\"https:\\\/\\\/version-2.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"The Iran Steel Industry Cyber Attack Explained\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"name\":\"Version 2\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/version-2.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#organization\",\"name\":\"Version 2\",\"url\":\"https:\\\/\\\/version-2.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"contentUrl\":\"https:\\\/\\\/i0.wp.com\\\/version-2.com\\\/wp-content\\\/uploads\\\/2020\\\/08\\\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1\",\"width\":1795,\"height\":335,\"caption\":\"Version 2\"},\"image\":{\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/version-2.com\\\/zh\\\/#\\\/schema\\\/person\\\/d14d2d3cd77ffdb618b9f1330fe084db\",\"name\":\"version2hk\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g\",\"caption\":\"version2hk\"},\"sameAs\":[\"http:\\\/\\\/version2xfortcom.wordpress.com\"],\"url\":\"https:\\\/\\\/version-2.com\\\/en\\\/author\\\/version2hk\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"The Iran Steel Industry Cyber Attack Explained - Version 2","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained","og_locale":"en_US","og_type":"article","og_title":"The Iran Steel Industry Cyber Attack Explained - Version 2","og_description":"A Change In The Air Iran\u2019s steel Industry was hit by a […]","og_url":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained","og_site_name":"Version 2","article_published_time":"2022-07-05T01:28:21+00:00","article_modified_time":"2022-08-22T06:11:08+00:00","og_image":[{"url":"https:\/\/blog.scadafence.com\/hubfs\/IranBlog.png","type":"","width":"","height":""}],"author":"version2hk","twitter_card":"summary_large_image","twitter_misc":{"Written by":"version2hk","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained#article","isPartOf":{"@id":"https:\/\/version-2.com\/2022\/07\/the-iran-steel-industry-cyber-attack-explained\/"},"author":{"name":"version2hk","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db"},"headline":"The Iran Steel Industry Cyber Attack Explained","datePublished":"2022-07-05T01:28:21+00:00","dateModified":"2022-08-22T06:11:08+00:00","mainEntityOfPage":{"@id":"https:\/\/version-2.com\/2022\/07\/the-iran-steel-industry-cyber-attack-explained\/"},"wordCount":366,"publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"image":{"@id":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained#primaryimage"},"thumbnailUrl":"https:\/\/blog.scadafence.com\/hubfs\/IranBlog.png","keywords":["SCADAfence","2022"],"articleSection":["SCADAfence","2022","Press Release"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/version-2.com\/2022\/07\/the-iran-steel-industry-cyber-attack-explained\/","url":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained","name":"The Iran Steel Industry Cyber Attack Explained - Version 2","isPartOf":{"@id":"https:\/\/version-2.com\/zh\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained#primaryimage"},"image":{"@id":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained#primaryimage"},"thumbnailUrl":"https:\/\/blog.scadafence.com\/hubfs\/IranBlog.png","datePublished":"2022-07-05T01:28:21+00:00","dateModified":"2022-08-22T06:11:08+00:00","breadcrumb":{"@id":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained#primaryimage","url":"https:\/\/blog.scadafence.com\/hubfs\/IranBlog.png","contentUrl":"https:\/\/blog.scadafence.com\/hubfs\/IranBlog.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.scadafence.com\/the-iran-steel-industry-cyber-attack-explained#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9801","item":"https:\/\/version-2.com\/"},{"@type":"ListItem","position":2,"name":"The Iran Steel Industry Cyber Attack Explained"}]},{"@type":"WebSite","@id":"https:\/\/version-2.com\/zh\/#website","url":"https:\/\/version-2.com\/zh\/","name":"Version 2","description":"","publisher":{"@id":"https:\/\/version-2.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/version-2.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/version-2.com\/zh\/#organization","name":"Version 2","url":"https:\/\/version-2.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","contentUrl":"https:\/\/i0.wp.com\/version-2.com\/wp-content\/uploads\/2020\/08\/v2-hk-hor-4.png?fit=1795%2C335&ssl=1","width":1795,"height":335,"caption":"Version 2"},"image":{"@id":"https:\/\/version-2.com\/zh\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/version-2.com\/zh\/#\/schema\/person\/d14d2d3cd77ffdb618b9f1330fe084db","name":"version2hk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d280627252b42d7489de74dd88aa04043a495f25e258575000dc767e287bf94c?s=96&d=identicon&r=g","caption":"version2hk"},"sameAs":["http:\/\/version2xfortcom.wordpress.com"],"url":"https:\/\/version-2.com\/en\/author\/version2hk\/"}]}},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/pbQRKm-dvT","post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/51949","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/users\/143524195"}],"replies":[{"embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/comments?post=51949"}],"version-history":[{"count":14,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/51949\/revisions"}],"predecessor-version":[{"id":55589,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/posts\/51949\/revisions\/55589"}],"wp:attachment":[{"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/media?parent=51949"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/categories?post=51949"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/version-2.com\/en\/wp-json\/wp\/v2\/tags?post=51949"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}