/
← Voltar ao feed
critical government water and wastewater energy critical infrastructure

Iranian-affiliated APT actors disrupt internet-exposed Rockwell, Schneider Electric and Siemens PLCs across US critical infrastructure

1 fonte(s) · 1 atualização(ões) · publicado 06/04/2026 08:03 · coletado há 1 dia

The FBI, CISA, NSA, EPA, DOE, CNMF and Treasury warn of ongoing exploitation of internet-exposed PLCs by an Iranian-affiliated APT group, with activity observed since at least March 2026. Targets are Rockwell Automation/Allen-Bradley, Schneider Electric and Siemens PLCs in the Government Services and Facilities, Water and Wastewater Systems and Energy sectors. The actors maliciously interacted with PLC project files and manipulated HMI and SCADA displays, causing operational disruption and financial loss in some cases. The agencies assess the escalation is likely linked to hostilities between Iran, and the US and Israel. The advisory was first published on April 7, 2026 and updated on July 22, 2026 to add new detection guidance and the Schneider Electric and Siemens targeting. It references earlier CyberAv3ngers (IRGC CEC) activity against Unitronics PLCs as similar historical behavior.

Technical Details

  • The actors connected to misconfigured, internet-facing PLCs from foreign, leased third-party hosting infrastructure using the vendors' own programming software.
  • Malicious inbound traffic targeted ports 44818, 2222, 102 and 502, and modems on port 22.
  • Targeted devices: Rockwell CompactLogix and Micro850, Schneider Electric BMX P34/Modicon M340, and Siemens S7-1200 series.
  • The actors used Studio 5000 Logix Designer, EcoStruxure Control Expert and TIA Portal to exfiltrate project files to actor-controlled infrastructure [T1041].
  • They modified or deleted project file logic, including Add-On Instructions (AOIs), and manipulated HMI/SCADA data [T1565]. The changes disabled critical shutdown and alarm logic, so systems could enter unsafe conditions without alerting operators.
  • At one US victim, a malicious project file kept the legitimate ladder logic but added logic that overrode the instruction sets maintaining safe operating parameters.
  • In one instance, Dropbear SSH on victim modems was used for remote access over port 22 [T1219].
  • The advisory states this is opportunistic targeting of misconfigured devices, not a new product vulnerability. No CVEs are cited, and the IOC lists are in the STIX files rather than the article text.

Remediation

  • Remove PLCs from direct internet exposure and use a secure gateway or jump host. Enforce firewall/ACL rules and block hosting-provider IPs.
  • Query logs for the published IOCs and for suspicious traffic on ports 44818, 2222, 102 and 502.
  • Place Rockwell controller mode switches in run position, after validating project files. Enable programming protection in TIA Portal for Siemens devices.
  • Review running project files and AOIs against known good logic. Verify backups are clean before restoring, and reimage connected devices if lateral movement is suspected.
  • Change default passwords, require MFA for remote OT access, secure and log cellular modems, keep offline backups of PLC logic, and keep PLCs patched.
  • Follow vendor hardening guidance: Rockwell SD1771, Siemens Security Bulletin 104599 and Schneider Electric's Modicon cybersecurity guide.

Linha do tempo

  1. cisa.gov ↗ · pub. 06/04/2026 08:03 · coletado 19/10 18:37 primeiro registro

    Iranian-affiliated APT actors disrupt internet-exposed Rockwell, Schneider Electric and Siemens PLCs across US critical infrastructure

    ler a análise desta fonte

    The FBI, CISA, NSA, EPA, DOE, CNMF and Treasury warn of ongoing exploitation of internet-exposed PLCs by an Iranian-affiliated APT group, with activity observed since at least March 2026. Targets are Rockwell Automation/Allen-Bradley, Schneider Electric and Siemens PLCs in the Government Services and Facilities, Water and Wastewater Systems and Energy sectors. The actors maliciously interacted with PLC project files and manipulated HMI and SCADA displays, causing operational disruption and financial loss in some cases. The agencies assess the escalation is likely linked to hostilities between Iran, and the US and Israel. The advisory was first published on April 7, 2026 and updated on July 22, 2026 to add new detection guidance and the Schneider Electric and Siemens targeting. It references earlier CyberAv3ngers (IRGC CEC) activity against Unitronics PLCs as similar historical behavior.

    Technical Details

    • The actors connected to misconfigured, internet-facing PLCs from foreign, leased third-party hosting infrastructure using the vendors' own programming software.
    • Malicious inbound traffic targeted ports 44818, 2222, 102 and 502, and modems on port 22.
    • Targeted devices: Rockwell CompactLogix and Micro850, Schneider Electric BMX P34/Modicon M340, and Siemens S7-1200 series.
    • The actors used Studio 5000 Logix Designer, EcoStruxure Control Expert and TIA Portal to exfiltrate project files to actor-controlled infrastructure [T1041].
    • They modified or deleted project file logic, including Add-On Instructions (AOIs), and manipulated HMI/SCADA data [T1565]. The changes disabled critical shutdown and alarm logic, so systems could enter unsafe conditions without alerting operators.
    • At one US victim, a malicious project file kept the legitimate ladder logic but added logic that overrode the instruction sets maintaining safe operating parameters.
    • In one instance, Dropbear SSH on victim modems was used for remote access over port 22 [T1219].
    • The advisory states this is opportunistic targeting of misconfigured devices, not a new product vulnerability. No CVEs are cited, and the IOC lists are in the STIX files rather than the article text.

    Remediation

    • Remove PLCs from direct internet exposure and use a secure gateway or jump host. Enforce firewall/ACL rules and block hosting-provider IPs.
    • Query logs for the published IOCs and for suspicious traffic on ports 44818, 2222, 102 and 502.
    • Place Rockwell controller mode switches in run position, after validating project files. Enable programming protection in TIA Portal for Siemens devices.
    • Review running project files and AOIs against known good logic. Verify backups are clean before restoring, and reimage connected devices if lateral movement is suspected.
    • Change default passwords, require MFA for remote OT access, secure and log cellular modems, keep offline backups of PLC logic, and keep PLCs patched.
    • Follow vendor hardening guidance: Rockwell SD1771, Siemens Security Bulletin 104599 and Schneider Electric's Modicon cybersecurity guide.