Iran Ceased Fire, Hackers Didn't: PLC Attacks on U.S. Infrastructure
On this page
Iran Ceased Fire, Hackers Didn't: PLC Attacks on U.S. Infrastructure
A diplomatic ceasefire between Iran and allied nations has failed to halt one of the most sustained cyber campaigns against U.S. industrial control systems in recent history. The disconnect between geopolitical agreements and the realities of cyber warfare has left programmable logic controllers (PLCs) , the brains of America's water treatment plants, energy grids, and municipal systems , exposed
Detail
On April 7, 2026, the FBI, CISA, NSA, EPA, Department of Energy, and U.S. Cyber Command's Cyber National Mission Force (CNMF) jointly released Advisory AA26-097A, confirming that Iranian-affiliated threat actors have been actively exploiting internet-facing PLCs across multiple U.S. critical infrastructure sectors since at least March 2026.
The advisory documented confirmed operational disruptions and financial losses at organizations in the water and wastewater, energy, and government services sectors. The timing was especially stark: the warning arrived the day before a ceasefire between Iran and allied nations was set to take effect.
The unprecedented collaboration of six federal agencies on a single OT-focused advisory signals that the U.S. intelligence community views this campaign as a Tier-1 national security threat , not merely a cybersecurity incident. When the EPA and DOE join the FBI and NSA on a joint advisory, it means the physical safety implications of PLC manipulation have crossed a threshold that demands cross-departmental urgency.
At the heart of the exploitation campaign is a critical authentication bypass vulnerability (CVE-2021-22681) in Rockwell Automation's Logix controllers, carrying a CVSS score of 9.8. The flaw allows attackers who have obtained Rockwell's shared cryptographic key to establish unauthorized EtherNet/IP sessions with Logix controllers over TCP port 44818.
Rockwell Automation controllers use a proprietary security key to validate that only authorized Rockwell software , such as Studio 5000 or RSLogix 5000 , communicates with the PLC. Once that key is compromised, any third-party tool can alter controller configurations, modify ladder logic, or disrupt physical processes. CISA added CVE-2021-22681 to its Known Exploited Vulnerabilities catalog on March 5, 2026, with a remediation deadline of March 26, 2026.
Rockwell Automation/Allen-Bradley Logix controllers running RSLogix (v16, v20) and Studio 5000 (v21+).
Network-based (AV:N), Low complexity (AC:L), No privileges required (PR:N), No user interaction (UI:N).
Sourcing help
Send the BOM for one quote covering active stock, EOL stock and cross-references.
Need a quote for this part?
Send us the part number or article link — we will confirm price, availability and lead time.
