Start with exposure. Advisory AA26-097A, written by the FBI, CISA, NSA, EPA, DOE, US Cyber Command and Treasury, says Iranian-affiliated actors have disrupted PLCs since at least March 2026. The advisory says this is not a new product flaw but opportunistic targeting of internet-facing controllers. The first check for any operator is a full list of what can be reached.
What does the advisory say about who is at risk?
The agencies name three sectors: government services and facilities, including local municipalities, water and wastewater systems, and energy. Affected products are potentially all internet-exposed PLCs, including Rockwell Automation and Allen-Bradley, Schneider Electric and Siemens. The 22 July update widened the scope to Schneider Electric, Siemens and potentially other brands, and added guidance on malicious changes in reusable code modules in Rockwell programs.
On attribution, the agencies assess that a group of Iranian-affiliated APT actors is behind the activity. The FBI says Iranian-affiliated targeting of US critical infrastructure has recently escalated, likely in response to hostilities between Iran, the US and Israel. The advisory mentions CyberAv3ngers only as earlier, similar activity. It does not say the 2026 group is that persona. Some victims saw operational disruption and financial loss. Our incident page on the Iranian PLC attacks holds the full record.
How did the attack flow work?
The advisory describes a short chain. Actors used foreign-based IP addresses and leased, third-party hosted servers to reach internet-facing PLCs. They used the makers’ own programming software to connect to misconfigured devices, then changed what the controllers did.
- Reach exposed PLCForeign-based IP addresses reach internet-facing controllers.Technique T0883 (MITRE ATT&CK, opens in a new tab)
- Use common OT portsInbound traffic on ports 44818, 2222, 102 and 502.Technique T0885 (MITRE ATT&CK, opens in a new tab)
- Remote access on modemsIn one case, Dropbear SSH on victim modems through port 22.Technique T1219 (MITRE ATT&CK, opens in a new tab)
- Take project filesConfiguration software moves project files to actor servers.Technique T1041 (MITRE ATT&CK, opens in a new tab)
- Change logic and screensLogic edited or deleted, HMI and SCADA data altered.Technique T1565 (MITRE ATT&CK, opens in a new tab)
The named devices include Rockwell CompactLogix and Micro850, Schneider BMX P34 and Modicon M340, and Siemens S7-1200. At one US victim the FBI saw a malicious project file that kept the normal ladder logic but added logic that overrode instructions keeping operating parameters safe. The changes disabled shutdown and alarm logic, so systems could enter unsafe conditions without alerting operators.
What should operators check first?
The point of this lesson is that each step above can be cut off before it works. A buyer or CISO can turn the advisory’s key actions into questions for the OT team and for integrators.
- Find exposed controllersIs there a current list of every PLC, HMI and modem reachable from the internet, including modems added by vendors?
- Remove direct exposureAre PLCs behind a secure gateway and firewall rather than directly on the internet?
- Read the logsDo logs show the advisory’s indicator IPs, or traffic on ports 44818, 2222, 102 and 502 from foreign hosting providers?
- Control remote accessIs remote access behind multifactor authentication, with default passwords changed?
- Compare the logicDoes running logic match known good logic, with shutdown and alarm logic intact?
- Keep offline backupsAre PLC logic and configuration backups tested and stored offline?
For Rockwell devices the agencies also advise putting the physical mode switch in the run position. They advise securing cellular modems with strong authentication and logs, and telling service providers about active threats to internet-connected PLCs. The advisory lists indicator IP addresses with association periods from January 2025 to July 2026, so checking older logs is worthwhile. Vet addresses before blocking them.
Where could the chain have been caught?
There are three places. The first is exposure discovery, before any connection is made. The second is inbound traffic on OT ports from hosting providers. The third is monitoring for project file or logic changes. The multi-nation secure connectivity guidance backs the same ideas: it lists limiting the exposure of connectivity and logging and monitoring all connectivity as principles, and says exposed OT connectivity is targeted by both opportunistic and highly capable actors.
How could threat intelligence monitoring give early warning?
Threat intelligence monitoring could flag risk sooner by watching for new government advisories and indicator lists that cover your PLC brands. It could also watch for remote-access details tied to your organization and for named actor activity in your sector. It cannot replace removing exposure. What it can do is tell you sooner that your devices are being scanned or targeted, so the checks above start earlier.
Is the 30 July water alert the same story?
Not on the evidence. CISA published a separate alert for the water and wastewater sector on 30 July 2026, with EPA and FBI contributing. It names no actor or country and says only “cyber threat actors”. Read it as a companion warning, not as proof of one actor.
The alert asks owners to disconnect PLCs from the internet, route remote access through a VPN or gateway, and allowlist IPs from known engineering laptops or critical OT assets. It also advises a known clean backup of the PLC image in case of lockout, and notes that cellular modems may be undocumented and missing from routine attack surface scans. That last point repeats the first question: you cannot protect a controller you have not listed.
An earlier advisory shows the same pattern. AA23-335A described IRGC-affiliated actors reaching US water facilities running Unitronics Vision PLCs from 22 November 2023, likely through devices with default or no passwords.
Related reading: NetScaler exposed edge: questions to ask your team.