Iran APT Sabotages US PLCs: CISA Warns of Physical Risk

The US government discloses an Iranian APT compromising internet-exposed PLCs in water and energy facilities, disabling safety logic to cause potential physical effects.

CISA, the FBI, NSA, DOE, and EPA issued a joint advisory updated July 22, 2026 on an active campaign by Iranian-affiliated threat actors against internet-exposed programmable logic controllers. The activity, observed since March 2026, has hit three US critical sectors: Government Services and Facilities, Water and Wastewater Systems, and Energy. The agencies document in detail for the first time how the attackers do not merely infiltrate but manipulate PLC project files to overwrite safety instructions and hide abnormal conditions from operators.

The escalation is assessed as a direct response to geopolitical tensions among Iran, the United States, and Israel. The shift from public defacement in 2023 to silent sabotage of industrial control systems marks an operational turning point with potentially physical consequences.

Key Takeaways

CISA and federal agencies confirm active targeting of Iranian internet-exposed PLCs since March 2026 across three US critical sectors
Attackers exfiltrate project files using legitimate vendor tools, then re-engineer ladder logic to disable alarms and automatic shutdowns
The July 2026 update expands target vendors from Rockwell Automation to Schneider Electric, Siemens, and potentially others
The FBI observed at least one case of a malicious project file allowing unsafe conditions without operator notification

How the Attack Works: From Port Scan to Ladder Logic Manipulation

The actors gain initial access by exploiting PLCs and OT devices directly exposed on the internet. The advisory identifies five specific ports: 44818, 2222, 102, 502 for industrial protocols, plus port 22 for SSH modems. This exposure, typical of architectures that assume "security by obscurity," eliminates any intermediary: the attacker interacts directly with the controller.

Once inside, the APT uses legitimate engineering software — Studio 5000 for Rockwell, EcoStruxure Control Expert for Schneider, TIA Portal for Siemens — to download the existing project file. Exfiltration occurs with the same tools operators use for maintenance, making it difficult to distinguish malicious activity from authorized activity.

The next phase is the most insidious. The attackers modify the ladder logic, the contact language that defines PLC behavior. In at least one case documented by the FBI, the re-introduced project file contained "added logic that overwrote specific sets of instructions responsible for maintaining safe operational parameters." The modification preserved downstream functionality — the system appeared normal — but disabled critical safety instructions.

The Hidden Phase: HMI and SCADA Lie to Operators

The manipulation does not stop at the PLC. The advisory describes interference with human-machine interface displays and SCADA systems, the panels through which operators read plant status. If process data is altered upstream or the PLC reports falsified values, the control center continues to see parameters apparently within normal range while the plant approaches unsafe conditions.

This deception architecture is technically refined: it does not require full IT network compromise, leaves no obvious ransomware traces, and generates no alarm. Persistence stems from the PLC executing legitimate code, only logically altered. Detection requires cross-audits between the loaded project file and running code, a non-standard practice in most utilities.

"The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs)."
— CISA Advisory AA26-097A, Executive Summary

From April to July 2026: Target Expansion

An initial government advisory issued in April 2026 had already flagged the escalation of Iranian campaigns against critical infrastructure. The July 22, 2026 update documents a significant expansion: target PLCs initially limited to Rockwell Automation/Allen-Bradley have broadened to Schneider Electric Modicon M340, Siemens S7-1200, and potentially other brands.

This vendor-agnostic expansion has immediate implications for the US industrial sector. This is not a specific vulnerability in a firmware, but a pattern applicable to any controller with exposed OT ports. The absence of cited CVEs in the advisory confirms the vector is not a technical zero-day but configurational: direct exposure, lack of segmentation, absence of robust authentication on industrial protocols.

The agencies report that victims suffered "operational disruption and financial loss." The dossier does not specify the extent of economic damage nor how many organizations were hit. It remains unverified whether malicious modifications were detected and corrected before causing concrete physical damage.

What We Know, What We Don't Know

The advisory does not attribute the specific name of the responsible APT group beyond the generic "Iranian-affiliated APT group" designation. The historical reference to CyberAv3ngers, the group that claimed defacement of Unitronics devices at more than 75 sites in 2023, is cited as a previous pattern but not as the confirmed identity of the current actor.

Unquantified remain: the exact number of victims, the identity of affected organizations, the extent of financial loss, and whether the July 2026 update represents a quantitative escalation or only a qualitative one compared to April.

What to Do Now

Federal agencies indicate immediate actions for PLC operators in the three target sectors. The priority is verifying internet exposure of OT ports: 44818, 2222, 102, 502, and 22 must be inventoried and, where possible, removed from the public attack surface. The advisory underscores that direct exposure of these ports is the documented entry vector in all observed cases.

Operators must audit project files loaded on PLCs, comparing running versions with verified pre-May 2026 backups. Detection of malicious logic specifically requires analysis of Add-On Instructions (AOIs) and safety routines, the same ones overwritten in the FBI incident.

For the four identified vendors — Rockwell Automation, Schneider Electric, Siemens, and potentially other brands — it is necessary to verify that engineering tools (Studio 5000, EcoStruxure Control Expert, TIA Portal) are accessible only from isolated workstations, not from terminals with general internet connectivity. The advisory documents that attackers use exactly these legitimate tools; limiting their access reduces the lateral movement surface.

Organizations in the Water and Wastewater Systems, Energy, and Government Services and Facilities sectors must treat this campaign with elevated priority, given the agencies' explicit assessment: the activity is "intended to cause destructive effects in the United States."

The Takeaway: When Cyber Becomes Kinetic by Design

The campaign documented in advisory AA26-097A represents a rare case study for its technical precision in linking cyber actions to potential physical consequences. This is not ransomware crippling an IT network causing indirect downtime, but surgical modification of control code that alters the plant's mechanical behavior while concealing its anomalies.

The choice of civilian targets — water, energy, public services — at a moment of high geopolitical tension transforms cyberspace into a parallel battlefield to conventional conflict. The fact that the entry vector is ordinary exposure of OT ports on the internet, not a sophisticated exploit, makes the problem structural and hardly solvable with point fixes. It requires an architectural redefinition of IT/OT isolation that many US utilities, and not only them, have not completed.

For the reader operating in the industrial sector, the lesson is that security by obscurity — the PLC won't be attacked because no one knows it exists — died when state APTs began systematically scanning the internet for open ports 44818 and 502. The July 22, 2026 advisory documents that someone found a target, learned to use the same tools as engineers, and demonstrated they can use them better.

Information is based on the cited source and current as of publication.

Sources

Sources and references