Iranian Hackers Blind Siemens, Schneider PLCs with Fake Sensor Data in Escalating ICS Campaign

Detail

at the hardware level, they don't just steal data; they rewrite physical reality. On July 22, 2026, a landmark joint advisory from seven U.S. federal agencies confirmed that Iranian-affiliated hackers have escalated a months-long campaign, extending their reach beyond Rockwell Automation into

, planting hidden code that blinds operators with falsified sensor readings while suppressing safety alarms.

This campaign represents a paradigm shift from ICS reconnaissance to active manipulation. The ability to falsify Human-Machine Interface (HMI) readings while disabling alarms means an attacker could cause physical damage , overpressure events, turbine overspeed, chemical mixing errors , long before any operator notices.

The sophistication of this campaign lies not in exotic zero-days, but in the attackers' ability to weaponize trusted industrial software. The advisory, jointly released by the FBI, CISA, NSA, EPA, DOE, and U.S. Cyber Command, details how threat actors leverage

, Rockwell's Studio 5000 Logix Designer, Schneider Electric's EcoStruxure Control Expert, and Siemens' TIA Portal , accessed through leased overseas infrastructure.

By routing connections through foreign IP addresses, the attackers mask their origin while connecting directly to internet-exposed PLCs. Once authenticated , or in many cases, bypassing authentication entirely , they deploy malicious ladder logic that silently substitutes genuine sensor data with fabricated values on operator screens.

Three major PLC families are now confirmed targets. At Rockwell Automation and Allen-Bradley sites, the attackers exploit