Iranian APTs Target U.S. PLCs: Unpatchable CVE-2021-22681…

Seven U.S. federal agencies confirmed an active Iranian APT campaign against Rockwell, Schneider, and Siemens PLCs. The critical CVE-2021-22681 authentication bypass will never receive a patch.

On July 22, 2026, seven U.S. federal agencies — the FBI, CISA, NSA, EPA, DOE, U.S. Cyber Command CNMF, and Treasury — released joint advisory AA26-097A detailing an active campaign by Iranian-linked APT actors against programmable logic controllers (PLCs) exposed to the internet. Targets include Rockwell Automation, Schneider Electric, and Siemens devices deployed across U.S. critical infrastructure. The technical core of the campaign is CVE-2021-22681, a critical authentication bypass flaw with a CVSS 9.8 score that Rockwell has confirmed cannot be patched without breaking compatibility with all deployed controllers.

Key Takeaways

Seven federal agencies co-signed advisory AA26-097A: the campaign is attributed to actors linked to the IRGC Cyber-Electronic Command (CEC), consistent with the CyberAv3ngers ecosystem.
Attackers use legitimate vendor engineering software — Studio 5000 Logix Designer, EcoStruxure Control Expert, TIA Portal — hosted on rented infrastructure to access PLCs and manipulate project files.
Over 30 Minnesota water and wastewater systems were hit on July 26–27, 2026; the city of Braham was forced to temporarily shut down its water treatment plant.

The Method: Legitimate Engineering as a Weapon

The threat actors do not rely on zero-day exploits or custom malware. According to advisory AA26-097A, they access PLCs through legitimate vendor configuration software hosted on rented servers. Where possible, they exploit CVE-2021-22681 to bypass authentication on internet-exposed Rockwell devices.

Once access is obtained, they download project files (.ACD for Rockwell), modify them offline, and re-upload them to the controllers. The primary modification targets Add-On Instructions (AOIs) — reusable code modules in which attackers overwrite safety parameters while preserving downstream operational logic. In parallel, they alter data displayed on HMI panels and SCADA systems, replacing real sensor readings with falsified values indicating normal conditions.

As TechTimes reports, citing the CISA advisory text: "An operator observing a display showing safe pressure, temperature, or chemical levels has no way to know whether those numbers reflect reality or an attacker-controlled fiction." Persistence is maintained via Dropbear SSH installed on compromised cellular modems, with traffic routed over standard industrial ports: 44818 (EtherNet/IP), 2222, 102 (Siemens S7), 502 (Modbus TCP), and 22 for SSH.

CVE-2021-22681: Technical Debt Becomes a National Threat

The vulnerability CVE-2021-22681 was disclosed in February 2021. It concerns an architectural flaw in the authentication mechanism of Rockwell Logix PLCs: the verification key is hardcoded such that the bypass is intrinsic to the Studio 5000 design. Rockwell has confirmed that no patch exists or is planned, because any fix would break compatibility with the entire installed base.

CISA added the CVE to the Known Exploited Vulnerabilities catalog on June 23, 2026, five years after the original disclosure. The impact is amplified by device prevalence: according to a Censys analysis from April 2026, 5,219 Rockwell/Allen-Bradley devices are exposed on the internet globally, of which 74.6% — 3,891 units — are in the United States.

Models specifically mentioned in the sources are the Allen-Bradley CompactLogix and Micro850, Schneider BMX P34 and Modicon M340, and Siemens S7-1200. The July 22, 2026 update extended the campaign's scope from Rockwell-only to a cross-vendor threat, fundamentally altering the risk profile for critical infrastructure operators.

The Minnesota Front: When the Attack Hits Home

Between July 26 and 27, 2026, over 30 Minnesota water and wastewater systems were hit by a coordinated attack with a common profile. TechTimes explicitly names four municipalities: Braham (population ~1,700), where the water treatment plant was temporarily shut down; Plymouth (population ~80,000), which preemptively disconnected connected cellular equipment; South St. Paul; and Maple Plain.

Tenable assessed that the operational pattern and timing of the Minnesota attack are consistent with the CyberAv3ngers ecosystem. This is, however, a private threat intelligence assessment; no official government attribution exists at this time for these specific incidents. The source does not specify whether the techniques used in Minnesota are identical to those of the broader campaign documented in AA26-097A, or represent an independent proliferation.

Braham Mayor Nate George is quoted by TechTimes: "Local governments in Minnesota are being asked to defend essential systems against foreign adversaries and sophisticated criminals, often with limited staff, outdated technology, and inadequate resources."

"A single exposed controller may look like a local weakness. In critical infrastructure, it can become part of a much larger national security problem." — Ross Filipek, CISO of Corsica Technologies

What to Do Now

Advisory AA26-097A and converging technical sources indicate four operational priorities for OT infrastructure operators:

Remove PLC internet exposure: disconnect controllers from the public network, remove industrial ports from perimeter gateways, and verify that cellular modems do not expose management services.
Segment OT networks from IT and the internet: isolate industrial control systems in dedicated VLANs or zones, with cross-zone traffic monitoring.
Audit PLC logic against known-good backups: compare current project files with verified offline copies from before the incident, with specific attention to modifications in Add-On Instructions (AOIs).
Verify that HMI/SCADA displays reflect real sensor data: implement cross-checks between digital readings and independent analog instrumentation, reducing reliance on a single visualization source.

The Limits of Response: When No Patch Exists

The unpatchable nature of CVE-2021-22681 shifts the problem from vulnerability management to architectural reconfiguration. Operators must replace controllers, redesign network topology, or both. For municipal utilities with limited budgets, this is a prospect spanning years, not weeks.

The campaign's expansion to Schneider and Siemens on July 22, 2026 eliminates the assumption that a vendor switch can resolve the risk. The dossier does not confirm whether Schneider and Siemens devices have vulnerabilities equivalent to CVE-2021-22681, or whether the expansion is opportunistic based on internet exposure and reconfigurability via legitimate software. Absent definitive patches, defensive posture depends entirely on attack surface reduction and independent verification of operational data.

The State Department has offered a $10 million reward for information on CyberAv3ngers activities. The financial incentive does not, however, solve the structural deficit: thousands of PLCs remain exposed, the majority in the United States, and the living-off-the-land technique makes the attack indistinguishable from legitimate management traffic until manual logic verification occurs.

Why This Signal Is Different

Previous CyberAv3ngers campaigns — such as the November 2023 operation against at least 75 Unitronics devices in Israel and the United States — targeted public exposure and visible disruption. The campaign documented in AA26-097A introduces a stealth dimension: overwriting operational reality without stopping processes, reducing the operator to a spectator of potentially falsified data.

The difference between a compromised PLC and an intact one is not detectable by traditional endpoint security or generic network monitoring. It requires specific OT security expertise, access to project backups, and the ability to analyze ladder logic or function block code — skills that small municipal utilities rarely possess in-house. Minnesota has shown where this gap leads: water service disruptions in communities of a few thousand residents, defended by mayors asking for resources that will not arrive in time for the next attack.

Frequently Asked Questions

Why can't CVE-2021-22681 be patched?

The vulnerability resides in the design of the Studio 5000 authentication mechanism, where the verification key is hardcoded. Fixing it would require changes that would render all deployed controllers incompatible. Rockwell has confirmed that no patch exists or is planned.

Are Schneider and Siemens devices vulnerable in the same way?

The dossier does not confirm specific vulnerabilities equivalent to CVE-2021-22681 for these vendors. The campaign's expansion to Schneider and Siemens may rely on internet exposure and the use of legitimate engineering software, rather than an identical critical flaw. The source does not specify the access mechanism for these devices.

How do you detect a compromised PLC if the HMI shows normal values?

The CISA advisory recommends comparing PLC project files against known-good backups and cross-verifying sensor readings with independent instrumentation. The falsification of HMI displays is designed to evade operator-centric monitoring, not a technical audit of controller logic.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references