CISA-FBI Alert: Rockwell MicroLogix PLCs Under Active Cyber Attack

Detail

, in water and wastewater utilities across at least seven U.S. states. The attacks have already degraded water operations, with adversaries remotely tampering with device configurations, changing IP addresses, setting unauthorized passwords, and modifying ladder logic in PLC project files.

The joint alert from CISA and the FBI underscores an urgent reality: critical infrastructure operators can no longer assume that legacy PLCs sitting behind a cellular modem are invisible to adversaries.

If a controller has a public-facing IP address, it is findable , and it is being found.

This campaign is not the work of elite nation-state actors exploiting zero-days. A directly reachable PLC is, as one security expert noted, "an indication of an organization that needs to mature its approach to OT management, not a sophisticated adversary." The attack surface is self-inflicted, which makes the remediation path unusually straightforward , but only if operators act immediately.

. In many cases, cellular modems installed by operators, vendors, or system integrators have gone undocumented in routine attack-surface scans. These modems create a bridge between the operational technology environment and the open internet , a bridge that security teams often do not know exists.

Once adversaries locate an exposed MicroLogix controller, they use standard manufacturer programming software to connect, extract project files, and modify logic. At least one victim organization reported discovering ladder logic discrepancies across multiple sites after comparing running PLC project files against known-good offline backups.

Threat actors scan for internet-exposed PLCs using Shodan-style OT search engines. MicroLogix 1100 and 1400 devices with public-facing IP addresses are identified within minutes.