July 24, 2026

July 2026 Update - Iran-Affiliated Threat Actors Targeting Critical Infrastructure Programmable Logic Controllers

Security Advisory Brief

On April 7, 2026, the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Environmental Protection Agency (EPA), the Department of Energy (DOE), and United States Cyber Command's Cyber National Mission Force issued joint Cybersecurity Advisory AA26-097A, warning that Iran-affiliated advanced persistent threat (APT) actors are actively exploiting internet-facing operational technology (OT) devices across multiple U.S. critical infrastructure sectors. The authoring agencies updated the advisory on July 22, 2026 — adding the Department of the Treasury as a co-author — to broaden the observed manufacturer scope, add new detection guidance and mitigations, and publish a refreshed set of indicators of compromise. The activity has caused disruptions within the Government Services and Facilities, Water and Wastewater Systems, and Energy sectors, and in a number of cases has resulted in operational disruption and financial loss.

The July update confirms that the campaign is not confined to a single vendor: the actors are observed targeting programmable logic controllers (PLCs) from Rockwell Automation/Allen-Bradley (CompactLogix and Micro850), Schneider Electric (Modicon M340 / BMX P34), and Siemens (S7-1200 series), and potentially other branded devices. In each case the adversary reaches internet-exposed controllers from overseas leased infrastructure and uses the vendors' own legitimate engineering software — Rockwell Studio 5000 Logix Designer, Schneider EcoStruxure Control Expert, and Siemens TIA Portal — to establish an accepted connection to the device. Rather than relying on a software exploit, the actors abuse the same configuration tooling that OT engineers use for routine work, then interact maliciously with the device project file and alter data presented on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. The port targeting observed (44818, 2222, 102, 502) is consistent with this multi-vendor scope.

The authoring agencies attribute this campaign to an Iran-affiliated APT group and assess the activity is intended to cause disruptive effects within the United States, likely in response to heightened hostilities between Iran, the United States, and Israel. The group is the successor to the Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command-affiliated actor publicly tracked as CyberAv3ngers — also referenced across government and industry reporting as HYDROKITTEN, BAUXITE, and APT Iran — which in November 2023 compromised at least 75 Unitronics PLC and HMI devices across critical infrastructure sectors, including Water and Wastewater Systems. The July update adds guidance for detecting malicious changes to reusable code modules within Rockwell PLC programs after the agencies observed malicious modules that disabled alarm and shutdown logic at a confirmed victim site — an indication the objective is physical consequence, not reconnaissance. Confirmed compromises in the current campaign date back to at least March 2026 and were identified through direct engagements with victim organizations.

Threats and Vulnerabilities

The core threat described in AA26-097A is the abuse of exposed OT devices with legitimate engineering software rather than a single software vulnerability, and it is mapped to the MITRE ATT&CK framework as Internet Accessible Device (T0883), Commonly Used Port (T0885), Remote Access Software (T1219), Data Manipulation (T1565), and — added in the July update — Exfiltration Over C2 Channel (T1041), reflecting the theft of controller project files using vendor configuration software running on leased infrastructure. The actors reach internet-facing PLCs from overseas-based IP addresses, connect with the vendor's configuration software, extract the device project file — on Rockwell devices the .ACD file containing ladder logic and configuration — and then replace or amend the logic. On Rockwell controllers this now includes malicious changes to reusable code modules (Add-On Instructions), observed at a victim to disable alarm and shutdown functions. Inbound malicious traffic was directed to OT-associated ports including 44818 and 2222 (EtherNet/IP), 102 (Siemens S7comm), and 502 (Modbus), as well as port 22, over which the actors deployed Dropbear Secure Shell (SSH) software on victim endpoints to maintain remote access. The July 22 update expanded the published machine-readable indicator set from eight to twenty-one IP-address indicators spanning multiple overseas hosting providers, which organizations should query against historical logs within the associated time frames while vetting each address before taking blocking action.

The advisory directs organizations with Rockwell Automation/Allen-Bradley controllers to review the manufacturer's prior guidance, which addresses CVE-2021-22681, an authentication bypass with a CVSS v3.1 base score of 9.8 that affects RSLogix 5000 versions 16 through 20 and Studio 5000 Logix Designer version 21 and later and allows an unauthenticated, network-based attacker to circumvent verification and communicate with Logix controllers. Rockwell has confirmed that CVE-2021-22681 cannot be fully resolved through a software patch: the weakness lies in how the cryptographic key that authenticates communication between Studio 5000 and Logix controllers is protected, a design condition that cannot be changed without significant architectural change to the controller communication model. This makes removing controllers from direct internet exposure and mediating all engineering access through a controlled gateway the primary risk-reduction measure rather than patching alone.

Client Impact

Organizations operating internet-exposed PLCs from Rockwell Automation/Allen-Bradley, Schneider Electric, or Siemens — as well as Modbus-capable controllers — face a direct risk of unauthorized manipulation of industrial processes. Because the actors interact with devices using the same engineering software as legitimate operators, malicious activity may closely resemble routine engineering connections and evade controls tuned only for known exploit signatures. The demonstrated impact includes extraction of controller project files, replacement of ladder logic and reusable code modules, disabling of alarm and shutdown logic, and manipulation of operator-facing HMI and SCADA data — any of which can lead to unsafe process states, service disruption, and financial loss. A large share of exposed devices are field-deployed on cellular modems at pump stations, substations, and municipal facilities, where remote reachability is often the only connectivity path and hardening is frequently overlooked.

Beyond the immediate operational risk, affected sectors carry regulatory and public-safety obligations that magnify the consequences of a successful intrusion. Water utilities operate under EPA oversight and Safe Drinking Water Act expectations, while energy operators may fall under NERC CIP requirements; an incident involving manipulation of control-system data or safety logic can trigger reporting obligations, regulatory scrutiny, and community-safety concerns. The alignment of the advisory's mitigations with the CISA and NIST Cross-Sector Cybersecurity Performance Goals 2.0 signals the baseline of practice against which regulators and insurers are increasingly measuring critical infrastructure operators.

Mitigations

The authoring agencies recommend the following actions to reduce exposure to this campaign and to similar targeting of internet-facing OT devices:

Remove PLCs and other OT devices from direct internet exposure, mediating all remote access through a secure gateway or jump host behind a firewall, eliminating inbound port exposure, and disabling cellular modems where remote access is not operationally required; where modems are required, secure their management interfaces with strong authentication and enable logging.
Query available logs for the twenty-one published IP-address indicators within their associated time frames, and inspect traffic on OT ports 44818, 2222, 102, 22, and 502 — particularly connections originating from overseas hosting providers — while investigating and vetting flagged addresses before taking blocking action.
Place controllers with a physical mode switch into the run position to prevent remote logic modification, returning devices to program or remote mode only during authorized updates; enable programming protection in the configuration software (for example, Siemens TIA Portal protection levels), and validate project-file integrity before switching a device back to run mode.
Implement multifactor authentication for access to the OT network from external networks, front PLCs with a VPN, proxy, gateway, or firewall that can enforce MFA and rate-limit repeated login attempts, change default device passwords and authentication keys, and disable unused services such as Telnet, FTP, RDP, VNC, and web interfaces.
Create, test, and store offline backups of PLC logic and configurations to enable rapid recovery, keep device firmware current with manufacturer patches during scheduled downtime windows, confirm third-party service providers and integrators are in scope for these controls, and monitor for unexpected configuration or reusable-code-module changes and for ICS-protocol functions that alter an asset's operating mode.

Organizations that identify affected internet-accessible devices should engage their incident response plans and contact the authoring agencies and the relevant vendor's product security team for investigation and remediation assistance.

1898 & Co. Response

1898 & Co. works alongside critical infrastructure owners and operators to reduce exposure to threats targeting operational technology environments like those described in this advisory. Our teams have experience supporting water, energy, and government asset owners in identifying internet-exposed control systems, segmenting OT networks, and hardening PLC and HMI deployments across Rockwell, Schneider Electric, and Siemens estates against unauthorized access.

Through OT-focused assessments, architecture reviews, external-exposure validation, and threat hunting, 1898 & Co. helps organizations locate internet-reachable controllers and engineering workstations, confirm that remote access is mediated through controlled gateways, and align their control-system security posture with the CISA and NIST Cross-Sector Cybersecurity Performance Goals referenced in this advisory. Our managed threat detection services are designed to surface the anomalous engineering connections, project-file interactions, reusable-code-module changes, and protocol activity characteristic of this campaign.

Should an intrusion occur, 1898 & Co. provides incident response and recovery support tailored to industrial environments, drawing on experience with ladder-logic and Add-On-Instruction integrity verification, controller recovery from validated backups, and coordination with vendors and government agencies. We work with clients to translate advisories such as this one into prioritized, actionable steps suited to their specific environments and regulatory obligations.

Sources

Cyberthreat