Article
Exposed PLCs: lessons from the 2026 US advisory
US agencies say Iranian-affiliated actors disrupted exposed PLCs. See the attack flow and what water, energy and public facility operators should check.
Read more
Significant cyber incident
Iranian-affiliated attacks on US industrial controllers
US agencies say Iranian-affiliated actors have been disrupting internet-exposed industrial controllers (PLCs) in US government, water and energy organizations since at least March 2026.
In short
US agencies say Iranian-affiliated actors have been disrupting internet-exposed industrial controllers (PLCs) in US government, water and energy organizations since at least March 2026. The advisory was published on 7 April 2026 and widened on 22 July 2026 to cover Rockwell, Schneider Electric and Siemens devices. The actors took copies of project files and changed logic and operator screens, in some cases disabling shutdown and alarm logic.
What happened
On 7 April 2026 US agencies, led by the FBI and CISA, published advisory AA26-097A. It warned of Iranian-affiliated actors disrupting internet-connected controllers (PLCs) in several US critical infrastructure sectors. The agencies say the activity goes back to at least March 2026.
On 22 July 2026 the advisory was updated. It added Schneider Electric and Siemens controllers to the Rockwell Automation devices first covered, and added guidance on spotting changed code modules. The agencies say this is not a new product flaw. It is opportunistic targeting of exposed, poorly protected devices.
On 30 July 2026 CISA issued a separate alert for the water sector. It describes a significant rise in attacks on exposed PLCs, with lockouts and boil water notices. That alert does not name an actor.
Timeline
-
22 November 2023
Earlier campaign: IRGC-affiliated actors begin accessing US water facilities using Unitronics PLCs (advisory AA23-335A)
-
January 2025
Earliest date the advisory gives for actor association with one listed IP address group
-
Since at least March 2026
Agencies identify, through victim engagements, an Iranian-affiliated group disrupting PLCs
-
7 April 2026
CISA, FBI, NSA, EPA, DOE, CNMF and Treasury publish advisory AA26-097A
-
May 2026 to June 2026
Advisory lists further actor IP addresses first associated in this period
-
July 2026
Advisory lists more actor IP addresses first associated this month
-
22 July 2026
AA26-097A updated: Schneider Electric and Siemens added, new guidance on Rockwell code modules, exfiltration of project files described
-
30 July 2026
CISA alert urges water and wastewater operators to remove exposed PLCs; boil water notices reported
How the attack worked
Finding and reaching exposed controllers
The actors used foreign-based IP addresses to reach internet-facing PLCs from Rockwell Automation, Schneider Electric and Siemens. They used leased, third-party hosted servers and the makers’ own programming software to connect to misconfigured devices. Internet Accessible Device (T0883) is the access method the advisory lists. The advisory says this is not a new product vulnerability.
Traffic targeted ports 44818, 2222, 102 and 502, which are common industrial protocol ports. The advisory lists this as Commonly Used Port (T0885). It also saw traffic aimed at modems on port 22. In one case the actors put Dropbear SSH software on victim modems for remote access, listed as Remote Access Tools (T1219).
Taking project files
The actors used configuration software (Studio 5000 Logix Designer, EcoStruxure Control Expert and TIA Portal) on leased infrastructure to move device project files out to their own servers. The advisory lists this as Exfiltration Over C2 Channel (T1041).
Changing logic and screens
After taking the files, the actors modified and deleted project logic, including Add-On Instructions, and altered data on HMI and SCADA displays. This is listed as Data Manipulation (T1565). At one victim the FBI saw a malicious project file that kept normal ladder logic but overrode instructions that keep operating conditions safe. The changes disabled shutdown and alarm logic, so systems could enter unsafe conditions without telling operators.
The separate water sector alert
CISA’s 30 July alert describes actors changing passwords to lock out operators and changing PLC IP addresses to disconnect them. It does not say these actors are the same as those in AA26-097A.
ATT&CK techniques
Who says who was behind it
Attributed by the FBI, CISA, NSA, EPA, DOE, US Cyber Command CNMF and Treasury, 7 April 2026 (updated 22 July 2026), to "a group of Iranian-affiliated APT actors".
The advisory says the agencies previously reported on similar PLC activity by CyberAv3ngers (aka Shahid Kaveh Group), affiliated with the IRGC Cyber Electronic Command. It does not say the 2026 group is CyberAv3ngers.
CISA's water sector alert of 30 July 2026 names no actor and no country. This page does not treat it as the same actor.
Impact
Organizations in several US critical infrastructure sectors (government services and facilities, water and wastewater, energy) had controllers disrupted. Some victims had operational disruption and financial loss. Victims are not named and no figures are given.
At one victim, changes disabled shutdown and alarm logic so systems could enter unsafe conditions without alerting operators.
CISA's separate 30 July 2026 water alert says exposed PLC targeting has resulted in boil water notices and sustained manual operations. It does not say how many systems or which actor.
Government and regulator response
- 7 April 2026: the FBI, CISA, NSA, EPA, DOE, CNMF and Treasury published AA26-097A with indicators and mitigations.
- 22 July 2026: advisory updated with new indicators, Schneider Electric and Siemens devices, and guidance on checking project files and code modules. Key actions: remove PLCs from direct internet exposure, check logs for the listed indicators and ports, and set Rockwell mode switches to run.
- 30 July 2026: CISA alert to water operators: disconnect PLCs from the internet, use a VPN or gateway, allowlist remote IPs, keep a clean backup. EPA and the FBI contributed.
- The advisory points owners to the PLC makers’ security contacts and hardening guidance for Rockwell, Schneider Electric and Siemens.
Lessons
-
Exposure is the entry point
The advisory says this is opportunistic targeting of exposed, poorly protected PLCs, not a new product flaw. Taking controllers off the internet removes the main route in.
-
Modems are part of the attack surface
Actors targeted cellular modems, and CISA says some may be undocumented and missed by routine scans. Keep a full list of remote connections.
-
Project files are targets, not just devices
Actors took project files and then changed logic. Compare running logic with known good copies and check reusable code modules.
-
Safety logic can be switched off
Changes disabled shutdown and alarm logic so operators were not told. Alarm and safety logic needs change control and monitoring.
-
Backups need to be clean and offline
CISA advises a known clean PLC backup in case of lockout, and says to check restored backups for malicious logic.
-
Do not assume one actor
CISA's water alert names no actor. Treat each government source on its own terms.
What to check in your own organization
-
Find exposed controllers
List every PLC, HMI and modem reachable from the internet, including cellular modems added by vendors or integrators that may be undocumented.
-
Check logs for the listed indicators
Search logs for the IP addresses in AA26-097A and for traffic on ports 44818, 2222, 102, 502 and 22, especially from foreign hosting providers. Vet the addresses before blocking.
-
Control remote access
Route remote access through a gateway or VPN with MFA, and allowlist known engineering laptops only.
-
Review project files
Compare running logic with known good logic, check Add-On Instructions or reusable modules, and confirm shutdown and alarm logic is intact.
-
Mode switches and passwords
Put physical mode switches in run position where they exist, and replace default or empty passwords.
-
Backups
Keep tested offline backups of PLC logic and configuration, and check them for malicious logic before restoring.
-
Early warning
Threat intelligence monitoring could flag risk early by watching for new government advisories and indicator lists for your PLC brands, exposed credentials and remote-access details tied to your organization, and named actor activity in your sector. It cannot replace removing exposure, but it can tell you sooner that your devices are being scanned or targeted.
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country United States This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America
Questions
Who is behind the 2026 PLC attacks?
US agencies attribute them to a group of Iranian-affiliated APT actors (advisory AA26-097A). The advisory references CyberAv3ngers as earlier similar activity but does not say it is the same group.
Which devices are affected?
Potentially all internet-exposed PLCs. Named targets include Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 and Siemens S7-1200.
Is there a software vulnerability to patch?
The advisory says it is not highlighting a new vulnerability. It describes opportunistic targeting of exposed, misconfigured devices.
Is the 30 July water alert the same campaign?
The alert does not name an actor or link itself to AA26-097A. It reports lockouts, IP changes and boil water notices at water systems.
What should I do first?
Remove PLCs from direct internet exposure, check logs for the advisory's indicators and ports, and review project files for unauthorized changes.
In our research
- Exposed PLCs: lessons from the 2026 US advisory October 2026
- CyberAv3ngers Threat group
Sources
- Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A) CISA
- CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs CISA
- IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities (AA23-335A) CISA
- Secure Connectivity Principles for Operational Technology (OT) UK NCSC with CISA, FBI and partners (hosted by FBI IC3)
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.