CISA Updates PLC Threat Advisory as Iran-Linked ICS Attacks Escalate

27 de julho de 2026

CISA Updates PLC Threat Advisory as Iran-Linked ICS Attacks Escalate

Programmable logic controllers , the embedded devices that regulate pumps, turbines, valves, and safety shutdowns across industrial facilities , have become a prime target in an escalating state-sponsored cyber campaign. In a newly updated joint cybersecurity advisory, the Cybersecurity and Infrastructure Security Agency (CISA), FBI, NSA, EPA, Department of Energy, U.S. Cyber Command, and Departme

3 min readContent reviewed 1 October 2026

Detail

The advisory , originally issued in April and updated in July , marks a significant escalation from earlier campaigns. Where previous Iranian-linked activity focused primarily on Israeli-manufactured Unitronics hardware, the current wave represents a deliberate platform shift toward Western-made controllers that dominate U.S. industrial environments. Cybersecurity firm Tenable assesses that the attack techniques have now proliferated to an estimated 60 or more affiliated pro-Iranian hacktivist groups.

The July update expanded the manufacturer scope beyond Rockwell Automation to include confirmed targeting of Schneider Electric and Siemens PLCs, with agencies noting that devices from other manufacturers may also be at risk. This broadening underscores a critical reality: no major PLC brand is immune, and the attack surface is only growing.

The expansion from Rockwell-exclusive targeting to multi-vendor exploitation signals a maturing adversary capability. Organizations running Schneider Electric Modicon or Siemens SIMATIC controllers can no longer treat this as a competitor-specific problem. The attack methodology , leveraging manufacturers' own programming software against misconfigured devices , is inherently vendor-agnostic.

The attack chain is deceptively straightforward. Adversaries scan for internet-facing PLCs using legitimate manufacturer programming software , such as Rockwell Automation's Studio 5000 Logix Designer , to connect to devices that have been deployed without adequate network segmentation or hardening controls. Once connected, the actors extract project files, modify or delete logic including Add-On Instructions (AOIs), and manipulate data displayed on human-machine interfaces (HMIs) and SCADA displays.

Critically, the intrusions have included disabling alarm and safety shutdown logic, allowing systems to enter unsafe conditions while operators remain blind to anomalies. The actors modify reusable code modules within project files , a technique that can propagate malicious changes across multiple controllers sharing a common code library, compounding the damage.

The advisory identifies specific ports associated with targeted OT protocols. Organizations should audit logs for suspicious traffic on:

Inbound connections on these ports from foreign-based IP addresses , particularly those associated with leased, third-party hosted infrastructure , should be treated as high-priority indicators of compromise.