Last week, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), the Environmental Protection Agency (EPA), the Department of Energy (DOE), U.S. Cyber Command, and the Department of the Treasury issued an updated joint cybersecurity advisory. This one detailed ongoing, aggressive cyber operations by Iranian-affiliated threat actors against U.S. critical infrastructure.

Initially flagged in April 2026, the joint threat advisory highlights an expanding scope of operational technology (OT) and industrial control systems (ICS) targeting across the Water and Wastewater Systems (WWS), Energy, Government Facilities, Healthcare, and Manufacturing sectors. Threat actors linked to Iran that include groups associated with the Islamic Revolutionary Guard Corps (IRGC) and Iranian intelligence—are actively exploiting internet-exposed Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), Supervisory Control and Data Acquisition (SCADA) systems, and remote field communications.

While earlier iterations of this campaign focused heavily on legacy or internet-connected Rockwell Automation equipment and Israel-origin Unitronics PLCs, updated intelligence confirms that adversaries have broadened their capabilities to target Schneider Electric and Siemens control systems. Attacks have resulted in operational disruptions, manipulation of HMI/SCADA data displays, altered controller project files, and direct financial losses for affected facilities.

Overview

The campaign centers on opportunistic and targeted exploitation of internet-accessible industrial control devices across North America, with broader strategic implications for allied nations. Adversaries leverage open-source intelligence (OSINT), mass port scanning, default/compromised credentials, and specific authentication bypass vulnerabilities to obtain direct network access to PLCs and cellular modems bridging field devices to external networks.

Once inside, attackers interact directly with controller project files, modifying operational logic, altering setpoints, and manipulating data feeds displayed to operators on SCADA screens.

[Internet / External Threat]

       │

       ├── Ports 44818, 502, 102, 2222, 22

       ▼

[Cellular Modem / Perimeter Router]  ── (Dropbear SSH Tunnel)

       │

       ▼

[Field Network / Insecure Gateway]

       │

       ├── Modified Project Files / Forced Logic Downloads

       ▼

[Programmable Logic Controllers (PLCs)]

  ├── Rockwell Automation Logix (CVE-2021-22681)

  ├── Schneider Electric Modicon M340 / BMX P34

  └── Siemens S7-1200 Series

       │

       ▼

[HMI / SCADA Displays] (Spoofed Readouts & Manipulated Data)

Timeline

• CVE-2021-22681 Disclosed (2021): Vulnerability discovered in Rockwell Automation’s Studio 5000 Logix Designer software, allowing non-Rockwell applications to discover secret cryptographic keys and communicate with Logix controllers.

• Late 2023 – Early 2024: CyberAv3ngers (IRGC-affiliated) exploits internet-facing Unitronics Vision Series PLCs in U.S. water utilities following the outbreak of the Israel-Hamas conflict, disabling systems and defacing HMIs.

• March 2026: Rockwell Automation updates its advisory regarding CVE-2021-22681, urging operators to remove controllers from the open internet, enforce strict mode-switch protections, and apply software hardening.

• April 7–8, 2026: CISA, FBI, NSA, EPA, DOE, and U.S. Cyber Command publish an initial Joint Cybersecurity Advisory warning that Iranian threat actors are exploiting internet-facing Rockwell Automation PLCs across water, energy, and municipal facilities, leading to data manipulation and financial losses. Censys identifies thousands of exposed Rockwell controllers on public IP addresses.

• June 2026: Pro-Iranian threat actor "Handala" claims credit for an intrusion targeting California Water Service (Cal Water). Investigations confirm activity was limited to accounts within third-party service provider platforms.

• July 22, 2026: Federal agencies issue updated Joint Advisory AA26-097A, expanding the threat landscape to include active targeting of Schneider Electric and Siemens PLCs, detailing cellular modem targeting via SSH/Dropbear, and recommending immediate hardware keylock mitigations.

Threat actor analysis

Attribution

Government advisories attribute the ongoing activity to Iranian state-sponsored advanced persistent threat (APT) groups and state-aligned proxies. Key entities associated with this activity include:

• CyberAv3ngers: Linked to the Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). Known for public-facing defacements, mass scanning, and direct destructive or disruptive targeting of OT hardware.

• Handala: A pro-Iranian threat actor group linked to Iranian intelligence services, specializing in hacktivism-style psychological operations, wiper software deployment, and third-party supply chain/service provider intrusions.

• Ministry of Intelligence and Security (MOIS)-Linked Contractors: Broader state-backed teams conducting intelligence collection and pre-positioning activities across energy and municipal networks.

Motivation

Iranian state cyber strategy balances asymmetric deterrence, geopolitical retaliation, and psychological operations. By targeting critical infrastructure such as municipal water distribution and regional power networks, Iranian actors seek to demonstrate reach, sow public panic, disrupt essential daily services, and inflict economic costs without crossing the threshold into outright kinetic warfare.

Evolution in OT Attack Tradecraft

Historically, Iranian cyber actors relied on simple web defacements, credential stuffing, and unauthenticated administrative access to basic HMIs or building management systems. The current campaign indicates a shift in operational maturity:

• Protocol-Aware Exploitation: Actors utilize official PLC engineering software and native industrial protocols (EtherNet/IP, Modbus TCP, Siemens S7) to directly push logic modifications.

• Living-off-the-Land (LotL) in OT: Rather than deploying custom industrial malware (such as PIPEDREAM or Industroyer), actors leverage legitimate OEM configuration tools and protocols to interact with project files, bypass controls, and alter runtime behavior.

• Field-Level Gateway Compromise: Targeting cellular modems on field sites via SSH (Dropbear) to create persistent, encrypted tunnels directly into Level 1 controller zones, bypassing enterprise firewalls.

Technical Analysis

Initial Access & Remote Access Pathways

• Internet-Facing Field Devices: Adversaries leverage Shodan, Censys, and custom scanning utilities to locate public IP addresses exposing industrial communication ports or remote management interfaces.

• Insecure Cellular Modems: Remote field locations (e.g., pumping stations, solar sites, substations) often rely on cellular modems for backhaul. Actors target open SSH (Port 22), Telnet (Port 23), or HTTP interfaces running default or weak credentials. In several instances, actors installed or leveraged lightweight Dropbear SSH instances to maintain persistent access.

• Third-Party & Vendor Managed Services: Access is gained via compromised credentials belonging to third-party contractors, integrators, or managed service platforms that maintain direct site-to-site connectivity into OT environments.

Targeted ICS/OT Technologies & Vulnerabilities

MITRE ATT&CK Mapping

MITRE ATT&CK for ICS

• Initial Access: T0886 (Remote Services), T0865 (External Remote Services), T0883 (Internet Accessible Device).

• Execution: T0807 (Command-Line Interface), T0855 (Unauthorized Command Message).

• Persistence: T0889 (Modify Program).

• Evasion: T0820 (Exploit Public-Facing Application), Protocol Bypasses.

• Impair Process Control: T0831 (Manipulation of Control), T0858 (Change Operating Mode), T0833(Modify Control Logic).

• Impact: T0826 (Loss of Availability), T0836 (Modify Parameter), T0856 (Spoof Reporting Message).

MITRE ATT&CK for Enterprise

• Reconnaissance: T1595 (Active Scanning - Port/IP Scanning), T1592 (Gather Victim Host Information).

• Initial Access: T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts - Vendor/Third-Party).

• Command and Control: T1572 (Protocol Tunneling via SSH/Dropbear), T1105 (Ingress Tool Transfer).

Sector-specific targeting: Water and energy

Water and Wastewater Systems (WWS)

The WWS sector remains vulnerable due to constrained municipal budgets, legacy equipment lifecycles, and a heavy reliance on automated remote management for geographically dispersed sites (e.g., booster stations, lift pumps, tank levels). Many small-to-medium utilities lack dedicated OT cybersecurity personnel, leading to directly exposed PLCs connected via cellular modems without VPNs or multi-factor authentication (MFA).

Energy Sector

In the energy sector, field devices like remote terminal units (RTUs) and PLCs regulate distribution substations, solar/wind generation collectors, and pipeline pressure stations. Exposure in this sector creates risks of localized power drops, trip conditions, or improper valve manipulations that could damage physical infrastructure or destabilize grid balance.

Operational impact assessment

Comprehensive Defensive Recommendations

Immediate Priority Actions (24–72 Hours)

1. Eliminate Direct Internet Exposure [CPG 3.S]:

   • Disconnect all PLCs, RTUs, and HMIs from direct public internet visibility immediately.

   • Audit public IP blocks using tools like Shodan/Censys to verify zero open OT ports (44818, 502, 102, 2222, 20256, 22).

2. Enforce Hardware Physical Mode Switches:

   • For PLCs equipped with physical mode switches (e.g., ControlLogix/CompactLogix), manually switch keylocks to "RUN" mode.

   • Critical Precondition: Prior to switching to "RUN", thoroughly review and validate running project files against gold-standard offline backups, as locking into RUN mode saves the active project state. Switching to RUN prevents unauthorized remote downloading or modification of underlying ladder logic.

3. Hardening Field Cellular Modems:

   • Audit cellular routers/modems for open management ports. Change all factory default credentials immediately.

   • Disable Telnet, HTTP, and unencrypted management protocols. Restrict SSH access (Port 22) to designated management IP ranges only. Inspect modems for unauthorized SSH services (e.g., Dropbear).

4. Enforce Mandatory MFA & Password Overhauls:

   • Require Multi-Factor Authentication (MFA) on all remote access pathways into the OT domain (VPNs, jump boxes, vendor portals).

   • Change default passwords across all PLC software, engineering tools, and web panels.

Short-Term Improvements (30–90 Days)

• Enable Controller & Software Level Protections: Configure software key switching and programming protection within engineering software (e.g., TIA Portal block protection, Studio 5000 project passwords) to restrict unauthorized logic transfers.

• Network Segmentation & Access Control Lists (ACLs): Restrict inbound communications to PLCs via strict firewall rules/ACLs, enforcing explicit IP-to-IP binding between known HMIs, engineering workstations, and PLCs.

• Cellular Architecture Isolation: Transition remote field modems to isolated network architectures, such as Private Access Point Names (APN), 5G Private Non-Public Networks (PNI-NPN), or cellular SD-WANs with Zero Trust Network Access (ZTNA).

• Log Centralization & Anomaly Monitoring: Collect and monitor system logs from firewalls, cellular modems, VPN gateways, and PLC event logs for abnormal connection attempts from foreign or hosting-provider IP ranges.

Long-Term Resilience Measures

• Zero Trust Architecture for OT Remote Access: Eliminate persistent, site-to-site incoming remote access tunnels in favor of broker-based, ephemeral, identity-centric access control models.

• Integrity Verification Automation: Implement continuous configuration monitoring tools that compare active controller logic checksums against authorized reference builds to detect unauthorized changes in real time.

• Supply Chain & Third-Party Governance: Enforce strict cyber requirements and audit rights for third-party integrators, cloud service providers, and remote maintenance vendors.

Alignment with Relevant Security Frameworks

Additional analysis and strategic implications

What this campaign reveals about Iranian cyber strategy

Iranian cyber operations demonstrate a pragmatic, low-cost strategy. Rather than expending high-value zero-day vulnerabilities or developing complex, custom malware frameworks (which require extensive development cycles), Iranian threat groups prioritize volume, speed, and opportunism. By scanning for publicly exposed devices and leveraging known engineering protocols, they achieve broad operational reach with minimal resource expenditure.

Evolution in OT attack tradecraft

While the targeting mechanism remains largely opportunistic, the operational tradecraft has progressed. Threat actors are demonstrating an improved understanding of industrial control platforms—moving beyond simple web interface vandalism to interacting with controller ladder logic, altering setpoints, and executing protocol-level commands across multiple major OEMs (Rockwell, Schneider Electric, Siemens, Unitronics).

Broader implications for global operators

This campaign serves as a critical warning for operators globally, including those in Europe, the Middle East, and Asia-Pacific. Iranian proxies use globally available OSINT scanning tools to discover exposed OT devices anywhere in the world. Any organization exposing unsegmented industrial controllers to the public internet—regardless of geographic location or size—is subject to automated discovery and potential disruption.

Common defensive weaknesses systemically exploited

• Direct Public Internet Visibility: Controllers wired directly to cellular modems without perimeter firewalls or private APNs.

• Over-Reliance on Vendor Default Configurations: Unchanged administrative passwords and open management ports.

• Inadequate Third-Party Risk Management: Insecure remote maintenance pathways provided to external contractors.

• Lack of Physical Hardware Security Toggles: Failure to set physical PLC keylocks to "RUN" mode, leaving remote programming ports permanently open.

Strategic takeaways for CISOs and OT security leaders

Action plan for CISOs and OT Leaders:

• Assume exposure until audited: Conduct immediate external exposure scans across all corporate and field IP spaces to verify no OT ports or management interfaces are visible to the public internet.

• Physically lock down controllers: Send field technicians to audit critical PLCs; ensure project files are verified and hardware switches are toggled to the RUN position.

• Isolate cellular backhaul: Move all field cellular communications to private APNs, secure VPNs, or Zero Trust architectures.

• Enforce rigid third-party access controls: Mandate MFA and jump-host mediation for all vendor and integrator remote access sessions.

• Bridge the operational gap: Foster direct collaboration between IT security teams and field OT engineers to ensure security policies do not impair operational safety or process continuity.