'Unsophisticated' hackers targeting systems used by oil and gas industry, CISA says

CISA, alongside FBI, EPA, and DOE, warns that unsophisticated actors are targeting ICS/SCADA across U.S. critical infrastructure—particularly Energy and Transportation—by exploiting poor cyber hygiene (e.g., internet-exposed OT, default credentials, insecure remote access). The guidance urges segmentation, removing OT from the internet, changing defaults, and ensuring manual operation capability; experts note rising CaaS and IT/OT convergence expanding the attack surface, with recent disruptions illustrating that basic methods at scale can have significant operational impacts.