The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about unsophisticated cyber actors targeting the oil and natural gas sectors in the US, specifically focusing on industrial control systems (ICS) and supervisory control and data acquisition (SCADA) technology. Despite using basic intrusion techniques, these actors exploit poor cyber hygiene and exposed assets, potentially leading to significant consequences such as operational disruptions and physical damage. CISA, along with the FBI, EPA, and DOE, has provided guidance to help organizations reduce the risk of such breaches. Key recommendations include removing public-facing operational technology (OT) devices from the internet, changing default passwords to strong ones, securing remote access with VPNs featuring phishing-resistant multifactor authentication (MFA), and segmenting IT and OT networks using demilitarized zones. Additionally, they advise practicing manual control operations to quickly restore functionality in the event of an incident. Organizations are encouraged to communicate regularly with third-party service providers and system manufacturers to ensure proper system configuration and security. The warning follows a trend of increased attacks on critical infrastructure, including last year’s string of Iranian attacks on water utilities using default passwords. The rise of crime-as-a-service (CaaS) operations has facilitated these attacks, providing adversaries with ready-made tools to breach unprotected infrastructure. The convergence of traditional IT and OT environments has expanded the attack surface, making it easier for threat actors to exploit vulnerabilities. With the evolving threat landscape, organizations must ensure comprehensive visibility across their systems and actively monitor suspicious activities to safeguard their infrastructure from both sophisticated and unsophisticated cyber threats. Heightened vigilance and proactive measures are of emphasis to mitigate such risks. Contact Ankura CTIX team if you are at risk and need help reinforcing your cyber safeguards.