US Warns Iranian Hackers Are Manipulating Siemens, Schneider, and Rockwell PLCs

U.S. federal agencies have updated a cybersecurity advisory warning that Iran-linked threat actors are targeting internet-exposed industrial control system devices and programmable logic controllers from Siemens, Schneider Electric, and Rockwell Automation. Investigators said the attackers used legitimate vendor programming software to connect to vulnerable PLCs, steal project files, alter ladder logic, and interfere with safety-related functions, including disabling shutdown and alarm mechanisms while manipulating HMI and SCADA displays to conceal the changes.

The activity has affected organizations in government services, facilities, energy, and water and wastewater sectors, with identified targeting that includes Rockwell CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 devices. The updated advisory adds refreshed indicators of compromise and detection guidance, and places the campaign in the broader pattern of Iranian operational technology intrusions associated with groups such as CyberAv3ngers and Handala, underscoring the risk of disruptive or destructive attacks against critical infrastructure.