Loading story…
A joint U.S. government advisory said Iranian-affiliated cyber actors are actively exploiting internet-facing operational technology devices across multiple U.S. critical infrastructure sectors, with a particular focus on Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs). The activity has affected organizations in Government Services and Facilities, Water and Wastewater Systems, and Energy, where attackers maliciously interacted with project files and manipulated data displayed on HMI and SCADA systems, causing operational disruption and financial losses for some victims.
The campaign has been observed since at least March 2026 and shows similarities to prior CyberAv3ngers activity linked to the IRGC Cyber Electronic Command. According to the advisory, the actors used overseas IP infrastructure, Rockwell Studio 5000 Logix Designer, OT-related ports including 44818, 2222, 102, 22, and 502, and Dropbear SSH for remote access. U.S. authorities urged operators to remove PLCs from direct internet exposure, harden remote access, enable logging, place controllers in run mode where appropriate, and review published indicators of compromise and ATT&CK-mapped TTPs alongside Rockwell Automation security guidance.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
U.S. federal agencies expanded their earlier warning on Iranian regime-affiliated attacks against internet-facing OT environments, broadening the scope beyond Rockwell Automation and Allen-Bradley PLCs to include Schneider Electric, Siemens, and possibly other PLC manufacturers. The revised advisory said the activity caused operational disruption and financial loss and warned that pressure from Iran-affiliated attackers is expected to continue.
On April 7, 2026, CISA and partner agencies warned that Iranian-affiliated actors were actively exploiting internet-facing PLCs, disrupting operations by manipulating project files and altering data shown on HMI and SCADA displays. The advisory also shared technical details, observed ports and tooling, indicators of compromise, and mitigation guidance for defenders.
Rockwell Automation published security advisory SD1771 addressing the PLC-focused threat activity referenced in later government reporting. The advisory was released on March 20, 2026.
Since at least March 2026, Iranian-affiliated cyber actors have targeted internet-exposed operational technology devices across multiple U.S. critical infrastructure sectors, especially Rockwell Automation/Allen-Bradley PLCs. The activity affected sectors including Government Services and Facilities, Water and Wastewater Systems, and Energy.
In 2026, suspected Iran-linked intrusions affected 30 to 36 Minnesota water utilities, and several utilities shifted to manual operations. The report says no confirmed water contamination occurred and formal U.S. government attribution remains pending.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 93 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
35 references tracked. Mallory keeps watching after this page renders.
lares.com
Open sourcewaterisac.org
Open sourcetherecord.media
Open sourceblog.polyswarm.io
Open sourcerockwellautomation.com
Open sourceinfosec.pub
Open sourceic3.gov
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. federal agencies have updated a cybersecurity advisory warning that Iran-linked threat actors are targeting internet-exposed industrial control system devices and programmable logic controllers from **Siemens**, **Schneider Electric**, and **Rockwell Automation**. Investigators said the attackers used legitimate vendor programming software to connect to vulnerable PLCs, steal project files, alter ladder logic, and interfere with safety-related functions, including disabling shutdown and alarm mechanisms while manipulating **HMI** and **SCADA** displays to conceal the changes. The activity has affected organizations in government services, facilities, energy, and water and wastewater sectors, with identified targeting that includes **Rockwell CompactLogix** and **Micro850**, **Schneider Electric Modicon M340**, and **Siemens S7-1200** devices. The updated advisory adds refreshed indicators of compromise and detection guidance, and places the campaign in the broader pattern of Iranian operational technology intrusions associated with groups such as **CyberAv3ngers** and **Handala**, underscoring the risk of disruptive or destructive attacks against critical infrastructure.
Aug 10, 2026
Water and wastewater utilities across at least seven U.S. states reported cyberattacks targeting industrial control systems, with Minnesota, Michigan, and Georgia among the states disclosing incidents and Minnesota saying more than 30 community water systems were hit during July 26-27. Officials said some utilities switched to manual operations, and the FBI warned that some activity degraded water operations, although states reporting publicly said impacts were limited and drinking water safety was not significantly disrupted. The attacks reportedly focused on older internet-connected operational technology, particularly **Rockwell Automation/Allen-Bradley PLCs**, while government guidance also warned that **Schneider Electric**, **Siemens**, and other PLC brands could be at risk. U.S. officials have not publicly attributed the campaign, but federal concern has centered on possible Iranian state-linked activity because the intrusions appeared disruptive rather than financially motivated. Reporting and prior threat intelligence have linked the activity to **CyberAv3ngers**, an IRGC-associated group previously tied to disruptive operations against water, manufacturing, and energy infrastructure, including the Municipal Water Authority of Aliquippa in Pennsylvania and water services in County Mayo, Ireland. OpenAI said it had earlier banned accounts assessed to belong to CyberAv3ngers after observing use of its models for reconnaissance, vulnerability research, code debugging, scripting help, and post-compromise tradecraft involving industrial control systems and PLC-related targets.
Aug 24, 2026
**Iran-linked CyberAv3ngers** activity targeting **Unitronics Vision PLCs** in internet-exposed operational technology environments is the clearest common security event in the provided material. The reporting describes campaigns against critical infrastructure, especially **water and wastewater systems**, with attackers exploiting **default credentials**, weak segmentation, and exposed OT assets to gain access and potentially disrupt operations or manipulate industrial processes. The activity is framed as part of broader Iranian state-linked cyber operations aligned with regional geopolitical tensions, with emphasis on U.S. and allied infrastructure at risk of operational and possible physical consequences. One reference provides technical and threat-context detail on the **CyberAv3ngers/IRGC-linked** targeting of Unitronics devices, while another discusses the wider cyber dimension of conflict involving Iranian groups pre-positioning in U.S. networks and threatening sectors such as water, hospitals, finance, and power. That second piece is relevant as contextual support for the same Iran-linked critical infrastructure threat environment, though it is broader and less specific to the **Unitronics PLC** intrusion pattern. The remaining references cover unrelated topics including malicious npm packages, GitHub repository compromise, Ivanti EPMM exploitation, a Ukraine-focused backdoor campaign, AI security commentary, and vendor detection updates, and do not describe the same incident or disclosure.
Jun 29, 2026