PLCs Exposed, Attacks Underway: Six US Agencies Issue Alert…

Six federal agencies have updated joint advisory AA26-097A warning of active attacks against internet-exposed PLCs in critical infrastructure. Unlike the 2023 campaign, this activity has caused confirmed operational disruption and financial losses. Attackers use legitimate engineering software and valid credentials, making the threat invisible to traditional monitoring.

On July 22, 2026, six US federal agencies updated joint advisory AA26-097A to warn of active attacks against programmable logic controllers (PLCs) in critical infrastructure that are directly exposed to the internet. Unlike the 2023 campaign, this activity has already caused confirmed operational disruption and documented financial losses for some victim organizations. The attackers do not exploit zero-day software vulnerabilities; they use legitimate engineering software and valid credentials, rendering the threat invisible to traditional monitoring systems.

Key Takeaways

Six federal agencies (FBI, CISA, NSA, EPA, DOE, US Cyber Command) co-signed the updated advisory AA26-097A on July 22, 2026, originating from the April 2026 alert.
Attackers connect to exposed PLCs using vendor-legitimate software — such as Rockwell Studio 5000 Logix Designer — with working credentials, generating traffic indistinguishable from authorized engineering sessions.
The update expands the scope beyond Rockwell Automation/Allen-Bradley to include Schneider Electric and Siemens, with identified traffic ports: 102 (Siemens S7comm), 2222 (EtherNet/IP implicit/UDP), 44818 (EtherNet/IP explicit/TCP, Rockwell).
The activity has caused confirmed operational disruption and financial losses; attackers alter control logic and in some cases manipulate operator interfaces (HMIs) to hide anomalies.
The risk of malicious hidden changes in shared reusable code modules emerges, with potential internal supply-chain propagation: a single edit can spread across an entire operation.

The "Trusted Technician" Who Doesn't Exist: How the Attack Works

Attackers scan the internet to identify exposed PLCs, then connect using the same engineering software an authorized maintainer would use. According to the advisory text cited by TrendMicro, "the connection appears as solid work performed by a technician" — a description that captures the core of the problem. From the network perspective, there is no anomaly to detect: the traffic comes from legitimate tools, with valid credentials, on ports expected by the industrial protocol.

Once access is obtained, attackers alter the underlying control logic of the PLCs. In some cases, they also modify what is displayed on operator screens. TrendMicro directly quotes the federal alert: attackers "have manipulated operator displays so that personnel could not visually detect any anomaly on their screens." This bidirectional manipulation — control and representation — neutralizes the primary human detection mechanism in OT control rooms.

From 2023 to 2026: What Changed and Why It's Worse

In November 2023, IRGC-CEC-affiliated actors known as CyberAv3ngers compromised at least 75 PLCs in US water facilities, including at least 34 in the Water and Wastewater Systems (WWS) sector, according to CISA advisory AA23-335a. That campaign was "largely non-disruptive": PLCs suffered defacement and ladder logic replacement, but operational impacts remained limited. The message left on Unitronics devices was explicitly ideological: "You have been hacked, down with Israel. Every equipment 'made in Israel' is CyberAv3ngers legal target".

The 2026 campaign reverses that trend. Advisory AA26-097A confirms that "this ongoing activity has caused confirmed operational disruption and financial losses for some affected organizations." The shift from demonstrative attacks to productive and financial impact marks a qualitative escalation. Target sectors — government services, water systems, energy infrastructure — remain overlapping, but the severity of consequences does not.

The July update also expands the perimeter of vendors involved: beyond Rockwell Automation/Allen-Bradley, the alert now explicitly includes Schneider Electric and Siemens. The reported traffic ports — 102, 2222, 44818 — cover the main industrial communication stacks, making the problem structural rather than tied to a single ecosystem.

Internet Exposure of PLCs: A Structural, Unresolved Problem

TrendMicro cites Shodan data indicating over 74,000 ICS devices would be directly reachable from the internet, down from approximately 120,000 recorded in the 2017-2023 period. These numbers are not independently verifiable: access to Shodan and trends.shodan.io was blocked by CAPTCHA/403 during editorial review. They remain indicative of a persistent problem — the quantitative reduction does not eliminate the qualitative criticality of physical control devices accessible via public IP.

The absence of network segmentation and direct internet exposure of PLCs are architectural vulnerabilities, not software flaws patchable with a firmware update. This radically changes the risk profile: defense does not require procurement of new devices, but reconfiguration of access control and network topology. The advisory, according to TrendMicro, emphasizes this aspect, focusing on configurative controls rather than hardware replacement.

"a single edit can spread across an entire operation"

Internal Supply-Chain Risk: Compromised Code Modules

A distinctive element of the 2026 update is the attention to shared reusable code modules. Internal libraries of automation routines — function blocks, add-on instructions, parameterized code blocks — are trusted assets that circulate among projects, sites, and teams. If compromised, they represent an internal supply-chain vector: a single malicious edit inserted into a shared module propagates through the entire installed base that imports it.

This mechanism is particularly insidious because it inverts the trust model: the code does not arrive from an external vendor with verification procedures, but from internal colleagues, corporate repositories, backups of previous projects. Verification of provenance and integrity of these artifacts is often absent in OT practices, where operational repeatability prevails over cybersecurity.

What to Do Now

Advisory AA26-097A indicates priority actions without requiring investment in new hardware. Operational recommendations converge on four directives.

OT Network Isolation and Segmentation. PLCs must not be directly exposed to the internet. Implementation of demilitarized zones and traffic filtering on identified industrial ports (102, 2222, 44818 and others relevant to the specific environment) reduces the attack surface without device replacement.

Credential Management and Access Control. The 2023 campaign exploited default or absent passwords on Unitronics PLCs. The 2026 activity uses valid credentials, indicating that rotation, complexity, and least privilege on engineering accounts remain fundamental controls. Access to programming tools must be restricted and monitored.

Programming Session Verification. Anomaly-based detection fails when traffic is generated by legitimate software with valid credentials. OT security must shift toward verification of every programming session: who connects, from which endpoint, with which project, in which authorized time window. Logging of ladder logic and HMI modifications must be centralized and not siloed per PLC.

Audit and Integrity of Reusable Code Modules. Organizations must map shared industrial code libraries, implement versioning with integrity verification, and track the provenance of every module imported into projects. This reduces the risk of propagation of malicious edits hidden in apparently trusted components.

Why the OT Sector Cannot Wait

Regulatory pressure is now explicit and multilateral: six federal agencies with competencies spanning national security, energy, environment, and military cyber defense have co-signed a single document. This signals that the threat to internet-exposed PLCs is classified as an intersection of national risks, no longer a peripheral security problem.

For vendors — Rockwell Automation, Schneider Electric, Siemens — the alert represents pressure on the default model: engineering software can no longer assume that any connection with valid credentials is legitimate. The debate on hardening by-default, multi-factor authentication on programming sessions, and integrated security telemetry in engineering tools will likely intensify in upcoming release cycles.

The dossier does not specify the formal identity of the 2026 campaign actors: the advisory describes the activity as "consistent with" the 2023 pattern, but does not name CyberAv3ngers or IRGC-CEC. The exact number of victims and the magnitude of financial losses remain unquantified. No documented infrastructure overlaps formally linking the 2026 operators to the 2023 group have emerged to date.

Frequently Asked Questions

Do the attacks exploit zero-day vulnerabilities on PLCs?
No. The advisory describes architectural exploitation: PLCs exposed to the internet, absence of segmentation, valid credentials compromised or mismanaged. No specific CVE or software defect is reported.

Why don't traditional security systems detect the attack?
Because the traffic is generated by vendor-legitimate software — such as Studio 5000 Logix Designer — with working credentials. From the network perspective, the session appears authorized. Anomaly-based detection is not enough: active verification of programming sessions is required.

Is the number of exposed devices verified?
The Shodan data cited by TrendMicro (over 74,000 ICS devices) is not independently verifiable due to blocked access. The historical trend (decline from approximately 120,000) is nevertheless cited as an indicator of a persistent problem.

Sources

Information has been verified against cited sources and updated at time of publication.

Sources

Sources and references