Iranian Hackers Expand PLC Targeting to Energy, Water, and Municipal Utilities Across US
On this page
Iranian Hackers Expand PLC Targeting to Energy, Water, and Municipal Utilities Across US
The convergence of geopolitical tension and internet-exposed operational technology (OT) has created a national security flashpoint. Since at least March 2026, Iranian-affiliated advanced persistent threat (APT) actors have been systematically breaching programmable logic controllers (PLCs) across American critical infrastructure, and their target list is only growing. The July 22, 2026 update to j
Detail
This advisory is not merely a routine update. It represents a significant escalation acknowledgment by six federal agencies, CISA, FBI, NSA, EPA, Department of Energy, and U.S. Cyber Command, that the threat surface has widened from predominantly water/wastewater systems to include energy generation, government facilities, and municipal utilities. The original April advisory covered roughly 75 compromised devices; the July update signals far broader exposure.
When the original advisory dropped on April 7, 2026, the focus was squarely on Water and Wastewater Systems (WWS). Iranian-affiliated actors had compromised internet-facing PLCs, primarily Rockwell Automation/Allen-Bradley units, to extract project files, modify ladder logic, and manipulate HMI displays. The July update tells a more alarming story.
The attacker playbook has not changed, but the address book has. The FBI and CISA now confirm targeting of PLCs manufactured by
, deployed across Government Services and Facilities, the Energy Sector, and municipal infrastructure. The geographic distribution, according to internet monitoring firm Censys, is heavily skewed toward the United States,
Nearly 4,000 industrial control devices remain vulnerable to this campaign, according to Censys research. The critical takeaway for industrial automation buyers: internet-connected PLCs without gateway protection are no longer a theoretical risk, they are confirmed attack vectors being actively exploited by nation-state actors.
Unlike ransomware campaigns that announce themselves, these intrusions are designed for stealth and long-term disruption. The adversary accesses PLCs through
using leased, third-party hosted infrastructure and legitimate manufacturer programming software. Once inside, the attack chain unfolds in three stages:
Sourcing help
Send the BOM for one quote covering active stock, EOL stock and cross-references.
Need a quote for this part?
Send us the part number or article link — we will confirm price, availability and lead time.
