Iranian Hackers Exploit Rockwell, Schneider, Siemens PLCs in Sustained OT Campaign
Share
Why This Matters Now
The industrial automation sector is confronting one of its most consequential cybersecurity inflection points in years. A joint advisory—designated AA26-097A and co-authored by seven U.S. federal agencies—reveals that Iranian state-sponsored threat actors have been systematically exploiting internet-exposed programmable logic controllers (PLCs) across American critical infrastructure since at least March 2026. The campaign has already resulted in operational disruptions and financial losses across government facilities, water and wastewater systems, and energy infrastructure.
First published on April 7, 2026, and significantly expanded on July 22, the advisory now confirms that the targeting extends well beyond the initially identified Rockwell Automation/Allen-Bradley controllers. Schneider Electric and Siemens PLCs are now confirmed targets, and the authoring agencies warn that devices from other manufacturers may also be in the crosshairs. For plant operators and system integrators, this is no longer a single-vendor problem—it is an industry-wide exposure crisis.
The Attack Surface: Nearly 4,000 Exposed U.S. Devices
Internet monitoring firm Censys, responding to the advisory with a threat intelligence brief, identified over 5,200 internet-connected devices globally that match the profile of targeted PLCs. Approximately 3,900—roughly three out of every four—are physically located within the United States. Nearly half of those devices are connected through Verizon wireless infrastructure, with AT&T accounting for an additional 13%.
The exposure is concentrated across the very sectors that the advisory flags: energy production, water treatment, and government services. These are not theoretical targets. The threat actors, linked to Iran's Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC) and operating under personas including CyberAv3ngers and Shahid Kaveh Group, have a demonstrated history of converting digital access into physical disruption.
Vendor Scope: From Rockwell to an Industry-Wide Threat
Rockwell Automation / Allen-Bradley
The initial advisory focused exclusively on Rockwell Automation CompactLogix and Micro850 controllers. These workhorse PLCs are ubiquitous in North American manufacturing and infrastructure. FBI investigators confirmed that in at least one U.S. victim environment, the attacker used configuration software to download a malicious project file directly to a running PLC. The July update adds critical detection guidance: organizations must now review reusable code modules within Rockwell PLC programs for unauthorized modifications—a technique that allows attackers to embed persistent logic-level backdoors that survive routine controller restarts.
Schneider Electric
The expanded advisory confirms targeting of Schneider Electric BMX P34 controllers within the Modicon M340 platform. These PLCs are widely deployed in water treatment, oil and gas, and discrete manufacturing. Port-scanning data gathered by U.S. Cyber Command indicates the threat actors are methodically mapping Schneider-exposed attack surfaces.
Siemens
Siemens S7-1200 series controllers are now explicitly named. The S7-1200 line is one of the most broadly adopted compact PLC families globally, present in everything from building automation to small-scale process control. Its inclusion signals that the campaign is opportunistic in nature—any internet-reachable PLC, regardless of brand, is a potential target.
Attack Techniques: What the Adversary Actually Does
The advisory details a consistent operational pattern. Attackers identify internet-facing PLCs, often through services like Shodan or direct port scanning. Once located, they leverage weak or default authentication—or in many cases, no authentication at all—to interact with the controller. Observed post-compromise activities include:
- Downloading and modifying project files running on the PLC
- Manipulating HMI and SCADA interface data to mask operational changes
- Modifying reusable code modules to establish persistent, logic-level access
- Altering input/output configurations to disrupt physical processes
The reusable code module vector, highlighted in the July 22 update, is particularly insidious. By corrupting a logic module that multiple routines reference, an attacker can achieve widespread impact while leaving the surface-level program logic appearing legitimate during routine audits.
The Geopolitical Context
The advisory arrives against the backdrop of active hostilities between Iran, the United States, and Israel that escalated in February 2026. The authoring agencies explicitly link the surge in PLC targeting to these geopolitical tensions, noting that the campaign is a direct escalation from earlier Iranian OT operations. This is not espionage-driven reconnaissance; it is disruption-oriented activity with demonstrable operational consequences.
Immediate Mitigation: Where to Start
The advisory's mitigation guidance is unambiguous and urgent. Organizations should execute the following steps immediately:
1. Disconnect PLCs from the Public Internet
The single most impactful action is to verify that no PLC is directly reachable from the public internet. This includes checking not only the controller itself but any network segment that provides a pathway. Use Shodan, Censys, or your own external scanning to confirm. Any device that responds to an external probe is a live target.
2. Implement OT Network Segmentation
Enforce the Purdue Model or ISA/IEC 62443 zones-and-conduits architecture. Place firewalls between IT and OT networks, and between the SCADA/HMI layer and the PLC layer. The goal is to ensure that even if an attacker breaches the corporate network, they cannot directly reach the control plane.
3. Audit Reusable Code Modules
For Rockwell Automation environments specifically, use vendor-provided integrity-checking tools to compare running programs against known-good project files. Visually inspect reusable logic modules and I/O configurations for anomalies. This is the new, July 22 detection recommendation—and it is designed to catch the most sophisticated attacks.
4. Harden Authentication and Access Controls
Replace default credentials immediately. Implement multi-factor authentication (MFA) wherever supported. Restrict remote access to OT environments using jump hosts, just-in-time access, and session logging. Vendor remote-support links should never be left persistently connected.
5. Deploy Continuous OT Monitoring
Use passive network monitoring tools capable of detecting unauthorized PLC interactions—such as unexpected project file downloads, logic changes, or anomalous protocol traffic—without disrupting fragile legacy controllers. Active scanning of PLCs should be approached with extreme caution, as it can fault running controllers.
Detection: What to Hunt For
The advisory includes specific indicators of compromise (IOCs) and detection guidance. Key hunt activities include:
- Reviewing PLC access logs for connections from unexpected IP addresses, particularly those associated with VPS providers
- Checking for unauthorized project file uploads or downloads using vendor configuration software audit trails
- Comparing the hash values of running firmware and logic against known-good baselines
- Monitoring for unexpected protocol activity on ports associated with Rockwell (EtherNet/IP on TCP 44818), Schneider (Modbus TCP on 502), and Siemens (S7comm on TCP 102)
- Investigating any HMI or SCADA display anomalies that could indicate data manipulation
FAQ: What Plant Operators Need to Know
Is this a new threat, or a continuation of earlier Iranian activity?
It is a continuation and escalation. The same IRGC-linked group, tracked as CyberAv3ngers (also Shahid Kaveh Group, Storm-0784, UNC5691), previously compromised at least 75 Unitronics PLCs across U.S. water facilities between November 2023 and January 2024. The current campaign is larger in scope, targets additional vendors, and employs more sophisticated logic-level manipulation techniques.
Are my PLCs vulnerable if they are behind a corporate firewall?
Potentially yes. If your OT network is flat or poorly segmented from the IT network, a compromise of any internet-facing corporate system could provide a pathway to the PLC. The advisory specifically warns against this scenario. Network segmentation between IT and OT environments is a core mitigation recommendation.
What are reusable code modules, and why do they matter?
Reusable code modules are program elements—such as Add-On Instructions in Rockwell's Studio 5000—that can be referenced by multiple routines within a PLC project. If an attacker modifies a reusable module, every routine that calls it is compromised simultaneously. This technique allows adversaries to embed malicious logic that is difficult to detect during surface-level code reviews, because the top-level program structure remains unchanged.
Does this advisory affect my regulatory compliance obligations?
Organizations in the water and wastewater, energy, and government sectors should treat AA26-097A as a directive to reassess compliance with frameworks such as NERC CIP, AWIA, and NIST SP 800-82. Regulators will expect documented evidence that the advisory's recommendations have been reviewed and acted upon. CISA has indicated that follow-up engagement with critical infrastructure owners is underway.
The Bottom Line
AA26-097A is not an abstract warning. It describes an active, ongoing campaign that has already caused operational disruption in U.S. critical infrastructure. The expanding vendor scope—from Rockwell to Schneider Electric to Siemens—confirms that the threat is not product-specific but connectivity-driven. Any internet-exposed PLC is a target.
For the industrial automation community, the advisory should trigger immediate action: verify exposure, segment networks, audit logic integrity, and harden access. The window between awareness and remediation must be measured in days, not months. The adversary is already inside the perimeter, and the next phase of this campaign will target whichever doors remain open.
