The Cybersecurity and Infrastructure Security Agency (CISA), along with several other US federal agencies, is warning critical infrastructure operators that the Iranian campaign against internet‑exposed Programmable Logic Controllers (PLCs) has expanded from targeting Rockwell Automation to include Schneider Electric and Siemens devices, including “potentially all internet‑exposed PLCs” with confirmed operational disruptions.
“CISA has consistently warned critical infrastructure stakeholders that Iranian-affiliated threat actors are conducting a range of targeted cyber activity to include compromising unsecured internet-connected accounts and devices,” said CISA Acting Executive Assistant Director for Cybersecurity Chris Butera. “CISA and our partners urge organizations to review this updated advisory and implement recommended actions to protect against this Iranian-affiliated threat activity,” Butera said.
Attacks targeting multiple U.S. critical infrastructure sectors underway
Since the recent U.S.-Iran conflict escalated earlier this year, Iranian-aligned threat actors have intensified attacks on U.S. critical infrastructure. The campaigns have already disrupted water and wastewater operations, energy environments and government or municipal systems. To date, the state-aligned threat actors have exploited exposed devices, tampered with controller logic or display data, and forced operators into costly recovery work.
Danielle Jablanski, cybersecurity consulting program lead, operational technology at civil engineering firm STV, described the current cyber conflict shy of being “warfare” during her presentation during OT.SEC.Con 2026. “In practice, critical infrastructure is a frequent target in [the] modern landscape of agreed competition. I won’t call it warfare, [it’s] a bounded zone of constant competitive cyber interaction that sits below the threshold of armed conflict,” Jablanski said.
The July 22 update (AA26‑097A) to the joint advisory said Iranian‑affiliated actors are exploiting internet‑connected PLCs across multiple U.S. critical‑infrastructure sectors and have disrupted operations and caused financial loss, particularly in water, wastewater, energy, and government/municipal environments.
Defending and mitigating OT-driven attacks
For operational technology (OT) sites, the first response step is to reduce or eliminate direct internet exposure for PLCs and other OT devices. The advisory’s main mitigation message is that organizations should restrict direct internet access to PLCs, secure remote‑access paths, and strictly control which systems and users can talk to controllers.
That essentially means ensuring controllers, modems, and human-machine interfaces (HMIs) are not directly reachable from the public Internet and that any remote engineering access is mediated through secure, authenticated channels with strong access control. Guidance from federal partners and industry analyses aligned to AA26‑097A reinforce this message by recommending private APNs (access point names) or non‑public cellular architectures for remote connectivity, rather than leaving field devices addressable from generic hosting providers. This architectural hardening is based on documented exploitation of internet‑facing OT devices, as documented in the advisory and related coverage.
AA26‑097A and closely related industry commentary emphasize locking down devices, including how and when PLC logic can change, and validating the integrity of project files. The advisory urges operators to review PLC project files for malicious changes and to secure deployments and configurations so that only authorized personnel can modify logic. Related industry guidance translates that to mean: restricting write access to defined maintenance windows, using available programming protections, logging and reviewing engineering changes, and hardening PLCs by disabling unnecessary services, changing default credentials, and maintaining current firmware across affected product families.
CISA’s update also provided new guidance for detecting recent malicious changes in reusable code modules used in Rockwell PLC programs and highlighted file integrity as a critical control. It’s advisable to maintain verified offline backups of known‑good project files and ladder logic, then compare those against what is running on controllers to spot unauthorized changes. Security industry analyses of the advisory also recommend using vendor integrity tools and building routines to review logic blocks and reusable modules for unexpected edits, deletions or additions.
When it comes to network traffic, advisory‑aligned analyses recommend monitoring for suspicious traffic on OT‑associated ports, typically Ethernet/IP, Modbus and S7 protocols, along with SSH, and paying close attention to connections from foreign hosting providers that don’t have a legitimate reason to reach PLCs or OT connections.
For HMI and SCADA, AA26‑097A stated that these adversaries have attempted to manipulate data displayed to operators, contributing to operational disruption and financial loss. The natural operational takeaway here is that sites should institutionalize cross‑checks between displayed values and ground‑truth measurements, using field instruments, historian data or independent channels. Treating discrepancies as potential indicators of compromise rather than just sensor noise is now recommended by experts, given the updated risks of data manipulation.
Finally, the July 22 update adds guidance, expands the vendor scope, and introduces additional indicators. CISA urges organizations to review TTPs and IOCs for both current and historical activity.
