Loading story…
U.S. federal agencies have updated a cybersecurity advisory warning that Iran-linked threat actors are targeting internet-exposed industrial control system devices and programmable logic controllers from Siemens, Schneider Electric, and Rockwell Automation. Investigators said the attackers used legitimate vendor programming software to connect to vulnerable PLCs, steal project files, alter ladder logic, and interfere with safety-related functions, including disabling shutdown and alarm mechanisms while manipulating HMI and SCADA displays to conceal the changes.
The activity has affected organizations in government services, facilities, energy, and water and wastewater sectors, with identified targeting that includes Rockwell CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 devices. The updated advisory adds refreshed indicators of compromise and detection guidance, and places the campaign in the broader pattern of Iranian operational technology intrusions associated with groups such as CyberAv3ngers and Handala, underscoring the risk of disruptive or destructive attacks against critical infrastructure.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Public reporting described a widening campaign targeting internet-exposed PLCs in U.S. water and wastewater systems across at least a dozen states. Minnesota said more than 30 water systems were targeted, and related incidents were reported in Georgia, Michigan, South Dakota, Alabama, and New Jersey, with some operators locked out of PLCs and forced to use manual workarounds.
U.S. federal agencies updated a cybersecurity advisory warning that Iran-linked threat actors are targeting internet-exposed industrial control system devices, including PLCs from Siemens, Schneider Electric, and Rockwell Automation. The update added detection guidance and refreshed indicators of compromise, and described attacker actions such as exfiltrating project files, modifying ladder logic, and disabling shutdown and alarm functions.
U.S. agencies said Iranian-affiliated threat actors have been observed since at least March 2026 targeting internet-exposed operational technology in the U.S. water and energy sectors. The activity included accessing exposed PLCs, exfiltrating project files, modifying controller logic, manipulating HMI/SCADA displays, and disabling shutdown and alarm functions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
19 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcelevelblue.com
Open sourcecybersecuritynews.com
Open sourceblog.polyswarm.io
Open sourcecommunity.gurucul.com
Open sourcetheregister.com
Open sourceic3.gov
Open sourcevifindia.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A joint U.S. government advisory said Iranian-affiliated cyber actors are actively exploiting internet-facing operational technology devices across multiple U.S. critical infrastructure sectors, with a particular focus on **Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs)**. The activity has affected organizations in Government Services and Facilities, Water and Wastewater Systems, and Energy, where attackers maliciously interacted with project files and manipulated data displayed on **HMI** and **SCADA** systems, causing operational disruption and financial losses for some victims. The campaign has been observed since at least March 2026 and shows similarities to prior **CyberAv3ngers** activity linked to the IRGC Cyber Electronic Command. According to the advisory, the actors used overseas IP infrastructure, **Rockwell Studio 5000 Logix Designer**, OT-related ports including `44818`, `2222`, `102`, `22`, and `502`, and **Dropbear SSH** for remote access. U.S. authorities urged operators to remove PLCs from direct internet exposure, harden remote access, enable logging, place controllers in run mode where appropriate, and review published indicators of compromise and ATT&CK-mapped TTPs alongside Rockwell Automation security guidance.
Aug 12, 2026
Water and wastewater utilities across at least seven U.S. states reported cyberattacks targeting industrial control systems, with Minnesota, Michigan, and Georgia among the states disclosing incidents and Minnesota saying more than 30 community water systems were hit during July 26-27. Officials said some utilities switched to manual operations, and the FBI warned that some activity degraded water operations, although states reporting publicly said impacts were limited and drinking water safety was not significantly disrupted. The attacks reportedly focused on older internet-connected operational technology, particularly **Rockwell Automation/Allen-Bradley PLCs**, while government guidance also warned that **Schneider Electric**, **Siemens**, and other PLC brands could be at risk. U.S. officials have not publicly attributed the campaign, but federal concern has centered on possible Iranian state-linked activity because the intrusions appeared disruptive rather than financially motivated. Reporting and prior threat intelligence have linked the activity to **CyberAv3ngers**, an IRGC-associated group previously tied to disruptive operations against water, manufacturing, and energy infrastructure, including the Municipal Water Authority of Aliquippa in Pennsylvania and water services in County Mayo, Ireland. OpenAI said it had earlier banned accounts assessed to belong to CyberAv3ngers after observing use of its models for reconnaissance, vulnerability research, code debugging, scripting help, and post-compromise tradecraft involving industrial control systems and PLC-related targets.
Aug 24, 2026
U.S. agencies including **NSA, CISA, FBI, DOE, and EPA** warned that threat actors are actively targeting **Siemens S7 Series PLCs** used across critical infrastructure, including water and wastewater, energy, chemical, food and agriculture, manufacturing, commercial facilities, and potentially the Defense Industrial Base. The advisory says attackers are focusing on **internet-exposed** controllers with outdated software, weak authentication, or known high-severity vulnerabilities, using **AI-generated Python scripts** disguised as legitimate monitoring tools and leveraging components such as `snap7.dll` and `python-snap7` to communicate with and exploit devices. Officials said the activity appears aimed at persistent reconnaissance and capability development that could support future disruption of industrial operations. A successful compromise could lead to process outages, safety incidents, equipment damage, sensitive data exposure, compliance issues, and cascading effects across connected environments. Agencies urged operators to inventory Siemens S7 assets, remove direct internet exposure, apply updates and patches, strengthen access controls, and increase monitoring for suspicious activity on OT networks.
Aug 24, 2026