U.S. Water and Power Sectors Face New ‘Ghostware’ Cyber Threats

U.S. government agencies including CISA and the NSA have issued an advisory warning of a new advanced‑persistent‑threat malware dubbed “Ghostware.” The exploit targets operational‑technology (OT) devices in critical‑infrastructure sectors such as water utilities and power generation, aiming to silently alter control‑system behavior over long periods. If undetected, the malware could cause subtle malfunctions that ultimately lead to outages or contaminated water supplies.

A separate CISA advisory highlights active exploitation of internet‑exposed programmable‑logic‑controllers (PLCs) by Iranian‑linked actors. The attackers have accessed systems from vendors such as Rockwell Automation, Schneider Electric and Siemens, modifying or deleting project logic, manipulating HMI/SCADA data, and disabling safety alarms. Agencies urge operators to remove direct internet exposure, validate controller configurations, enforce multi‑factor authentication for remote access, and monitor for unauthorized changes.