Iranian Hackers Exploit Rockwell, Schneider, Siemens PLCs in Sustained OT Campaign

Detail

First published on April 7, 2026, and significantly expanded on July 22, the advisory now confirms that the targeting extends well beyond the initially identified Rockwell Automation/Allen-Bradley controllers. Schneider Electric and Siemens PLCs are now confirmed targets, and the authoring agencies warn that devices from other manufacturers may also be in the crosshairs. For plant operators and system integrators, this is no longer a single-vendor problem, it is an industry-wide exposure crisis.

The July 22 update is not merely a routine revision. It signals that intelligence agencies have observed an expanding operational playbook, one that now weaponizes

within Rockwell PLC programs. This shift from basic unauthorized access to logic-level manipulation represents a dangerous escalation in OT-specific tradecraft.

Internet monitoring firm Censys, responding to the advisory with a threat intelligence brief, identified over 5,200 internet-connected devices globally that match the profile of targeted PLCs. Approximately 3,900, roughly three out of every four, are physically located within the United States. Nearly half of those devices are connected through Verizon wireless infrastructure, with AT&T accounting for an additional 13%.

The exposure is concentrated across the very sectors that the advisory flags: energy production, water treatment, and government services. These are not theoretical targets. The threat actors, linked to Iran's Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC) and operating under personas including CyberAv3ngers and Shahid Kaveh Group, have a demonstrated history of converting digital access into physical disruption.

The Censys data underscores a structural vulnerability that has persisted for years: OT devices were never designed for direct internet exposure. The accelerating convergence of IT and OT networks, combined with remote-access demands post-pandemic, has eroded the air gap that once protected industrial controllers. Organizations that have not conducted rigorous OT network audits in the past 12 months should treat this advisory as a forcing function.

The initial advisory focused exclusively on Rockwell Automation CompactLogix and Micro850 controllers. These workhorse PLCs are ubiquitous in North American manufacturing and infrastructure. FBI investigators confirmed that in at least one U.S. victim environment, the attacker used configuration software to download a malicious project file directly to a running PLC. The July update adds critical detection guidance: organizations must now review