CISA: Remove Rockwell PLCs from Internet Now — Iranian OT Attacks Surge
On this page
CISA: Remove Rockwell PLCs from Internet Now , Iranian OT Attacks Surge
The era of casually internet-connected industrial controllers is over. In an updated joint advisory issued July 22, 2026, six U.S. federal agencies , including CISA, the FBI, NSA, and U.S. Cyber Command , delivered an unambiguous directive to critical infrastructure operators: immediately sever direct internet connections to all Rockwell Automation and Allen-Bradley programmable logic controllers.
Detail
This is not a theoretical vulnerability disclosure. The advisory confirms that Iranian threat actors , aligned with the IRGC Cyber-Electronic Command (IRGC-CEC) , are actively inside U.S. OT networks right now. The replacement of legitimate ladder logic with attacker-controlled code represents one of the most dangerous forms of industrial cyber sabotage, capable of causing physical equipment damage, service disruption, or latent logic-triggered failures weeks after initial access.
The current wave of attacks traces a direct lineage to the November 2023 "CyberAv3ngers" incidents, in which IRGC-affiliated operatives compromised at least 75 Unitronics PLC/HMI devices across U.S. water and wastewater facilities. Those attacks exploited a depressingly simple vector: default credentials on devices exposed to the public internet via TCP port 20256. The attackers defaced HMIs with politically charged messages, but more critically, they demonstrated the ability to manipulate physical processes at will.
Fast forward to mid-2026, and the playbook has evolved dramatically. The advisory now names
, along with PLCs from Schneider Electric and Siemens, as confirmed targets. The shift from Unitronics , a niche Israeli manufacturer , to the Rockwell ecosystem signals a major capability escalation. Rockwell controllers dominate North American industrial infrastructure, from water treatment and power generation to discrete manufacturing and government facilities.
The Rockwell Automation installed base accounts for an estimated 40-45% of the North American PLC market across critical infrastructure sectors. A compromise vector targeting Rockwell specifically , rather than smaller OEMs , multiplies the potential victim pool by an order of magnitude. For industrial automation end-users, this advisory effectively rewrites the risk calculus for every internet-facing CompactLogix and Micro850 deployment.
The most alarming technical detail in the advisory concerns the nature of the compromise itself. Threat actors are not merely scanning or probing exposed PLCs , they are
that persists in the field even after initial detection efforts. This goes far beyond the HMI defacement tactics observed in 2023.
Sourcing help
Send the BOM for one quote covering active stock, EOL stock and cross-references.
Need a quote for this part?
Send us the part number or article link — we will confirm price, availability and lead time.
