Key Takeaways
- On 22 July 2026, CISA, the FBI, NSA, and five other US agencies updated joint advisory AA26-097A, expanding the scope of an ongoing Iranian-affiliated campaign against internet-exposed PLCs from Rockwell Automation to now include Schneider Electric and Siemens devices [1].
- The update adds a new exfiltration technique (MITRE ATT&CK T1041): actors are using vendors’ own legitimate engineering software to steal PLC project files from victim environments [1].
- At one confirmed US victim, actors modified ladder logic to disable safety shutdown and alarm functions, allowing unsafe conditions to develop without alerting operators [1].
- Government Services, Water and Wastewater Systems (WWS), and Energy sector organisations are named as directly affected; the multi-vendor scope means the realistic exposure is broader.
- New IOCs and mitigation guidance are available, but the core weakness enabling this campaign — internet-exposed OT, often reachable via cellular modems — has been publicly known since at least April 2026 [1][4].
Why This Update Matters Now
Advisory AA26-097A is not a new warning — it was first published on 7 April 2026, when the authoring agencies (FBI, CISA, NSA, EPA, DOE, and US Cyber Command’s Cyber National Mission Force) disclosed active exploitation of internet-exposed Rockwell Automation/Allen-Bradley PLCs by an Iranian-affiliated group [1]. That group has been previously tracked under the CyberAv3ngers alias, tied to Iran’s IRGC Cyber Electronic Command, and is the same actor set implicated in the 2023 Unitronics PLC compromises across US water utilities [5].
The 22 July 2026 update adds new guidance on detecting malicious changes in reusable code modules exploited within Rockwell Automation PLC programs, and expands scope to include observed targeting of Schneider Electric, Siemens, and potentially other branded PLCs [1]. The Department of the Treasury also joined as a co-authoring agency, an addition worth noting given the financial-sector implications of Treasury’s involvement.
For CISOs overseeing critical national infrastructure, the update signals two things: the campaign has not been contained by the original advisory’s mitigations, and the actors’ targeting logic is protocol- and port-based rather than vendor-specific — meaning any internet-exposed PLC, regardless of manufacturer, is realistically in scope.
What Actually Changed in the Update
The July revision is substantive rather than cosmetic. Three additions stand out.
Expanded Manufacturer and Device Scope
The advisory now names specific targeted models: Rockwell’s CompactLogix and Micro850, Schneider Electric’s BMX P34/Modicon M340, and Siemens’ S7-1200 series. Inbound malicious traffic has been observed on ports associated with each vendor’s protocols — 44818 and 2222 for Rockwell, 102 for Siemens, and 502 for Modbus — alongside port 22 targeting on connected cellular modems [1].
A New Exfiltration Technique
For the first time, the advisory documents actors using the vendors’ own configuration software — Rockwell’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ TIA Portal — on leased, third-party infrastructure to pull device project files out of victim environments (MITRE ATT&CK T1041). This is a “living off the land” pattern: no exploit is required, because the tools used are the same ones legitimate engineers and integrators use daily [1].
Confirmed Safety-Logic Tampering
In one documented case, actors downloaded a malicious project file that preserved the PLC’s downstream ladder logic function but overrode the instruction sets responsible for maintaining safe operating parameters — disabling shutdown and alarm logic so operators would not be notified when the system entered an unsafe state. This is the detail that should reframe the conversation for CNI leaders: this is not credential theft or data exposure, it is a direct line to physical-process manipulation [1]. IOActive research has repeatedly shown how attackers can blind the humans in the loop: our study SCADA and Mobile Security in the IoT Era found that more than 20% of the vulnerabilities identified across dozens of ICS mobile applications could let an attacker misinform operators or influence the industrial process directly [7].
Who Is Affected by This Update?
Water and Wastewater Systems Operators
WWS remains a named sector, consistent with the actor group’s history since the 2023 Unitronics campaign [5]. Many WWS facilities rely on cellular-connected PLCs for remote pump stations and field sites — precisely the exposure pattern flagged in this advisory.
Energy Sector Asset Owners
Named alongside WWS, energy sector organisations running any of the three named vendors’ controllers should treat this as a direct exposure notice, not general awareness content.
Government Services and Facilities, Including Municipalities
Smaller municipal operators frequently lack the OT security maturity of larger CNI operators, and their PLC deployments may be exposed without an internal team fully aware of the risk.
Integrators and Managed Service Providers
The advisory specifically calls out that service providers may be maintaining internet connectivity to OT systems for remote monitoring purposes without being aware of active threat targeting — placing a burden on operators to proactively brief their vendors and MSPs [1].
Security Leaders in Adjacent Sectors
Rockwell, Schneider Electric, and Siemens PLCs are used far beyond the three named sectors — in manufacturing, transportation, and building automation. CISOs outside WWS, Energy, and Government Services should not assume this advisory doesn’t apply to them.
Open Questions and Risk Context
Independent research adds useful context the advisory itself doesn’t fully quantify. Censys identified 5,219 internet-exposed hosts globally responding to EtherNet/IP on port 44818 and self-identifying as Rockwell Automation/Allen-Bradley devices when the original advisory was published in April [3] — and a large share of that exposure traced back to cellular carrier networks rather than fixed corporate connections, indicating field-deployed devices such as pump stations and substations reachable through cellular modems as their sole path to the internet. Comparable exposure figures for Schneider Electric and Siemens devices under this expanded campaign have not yet been independently published at the time of writing; organisations should treat any current third-party exposure estimate for those vendors with appropriate caution.
It’s also worth flagging what the advisory explicitly does not claim: this is not a new vulnerability disclosure. The authoring agencies state that this activity reflects opportunistic targeting of exposed devices, not a vendor-specific flaw — device manufacturers are urged to adopt secure-by-default design, but no new CVE is attached to this update [1]. Organisations should not wait on a vendor patch; the primary mitigation is architectural (removing internet exposure), not a fix to be deployed.
Finally, attribution to a specific Iranian-affiliated group beyond the general IRGC-CEC/CyberAv3ngers lineage has not been formally re-confirmed in the July update — the advisory refers to “an Iranian-affiliated APT group” without reasserting the CyberAv3ngers name directly in the new content [1]. CISOs briefing boards should be precise about what is confirmed versus inferred from the group’s historical TTP overlap.
How IOActive Can Help
IOActive’s work in critical infrastructure spans the technical and strategic worlds of OT and ICS security, from the semiconductor inside a controller to the governance programme around it. Our team has operated in ICS environments since building the first proof-of-concept worm against the smart grid in 2009 [8], and has helped define standards and best practices including NIST 800-53 and 800-37. The services below map directly to the exposure pattern AA26-097A describes — internet-reachable PLCs, legitimate engineering tools turned against their owners, and safety logic that can be altered without detection.
Full Stack Security Assessments
Most providers scan at the network or application layer only. Our Full Stack assessments examine the entire environment, drilling down to the facility and silicon level and up through the personnel, process, and supply-chain layers around it. For the exposure this advisory describes, that means identifying internet-facing Rockwell, Schneider Electric, and Siemens controllers, testing the OT/IT boundary and the cellular-modem paths that so often provide the only route in, and — drawing on our hardware research background — examining the firmware and silicon of PLC and HMI devices themselves through penetration testing, reverse engineering, side-channel analysis, and fault injection. It is the same class of work behind our research Compromising Industrial Facilities from 40 Miles Away, which showed how a memory-corruption flaw in widely deployed industrial wireless automation devices could be exploited remotely to disable field sensor nodes — exactly the kind of remotely reachable field connectivity the advisory flags at cellular-connected pump stations and substations [6].
Red Team and Purple Team Services
The advisory’s most alarming detail — actors modifying ladder logic to disable safety shutdown and alarm functions without alerting operators — is exactly the scenario adversarial testing exists to surface. Our Red Team engagements emulate the tradecraft of the Iranian-affiliated actors described here, including the “living off the land” use of vendors’ own engineering software in place of exploits, while our Purple Team work translates those findings into measurable improvements in whether your monitoring would actually detect project-file tampering and unauthorised logic changes in time to act.
Supply Chain Integrity
AA26-097A places a specific burden on integrators and managed service providers maintaining remote connectivity to OT systems, and documents the vendors’ own configuration software — Studio 5000 Logix Designer, EcoStruxure Control Expert, and TIA Portal — being used as an exfiltration channel. Our Supply Chain Integrity service assesses the security posture of technology providers and critical third parties, reviewing firmware, embedded systems, remote-access arrangements, and procurement processes for inherited risk before it becomes an incident vector.
Secure Development Lifecycle
The advisory urges device manufacturers to adopt secure-by-default design rather than leaving operators to compensate for exposed controllers. For the vendors and OEMs in the PLC and HMI supply chain, our Secure Development Lifecycle work embeds security review into design and engineering — from threat modelling through code review and pre-release testing — so that the next generation of devices does not ship with the internet-reachable defaults this campaign depends on.
Advisory Services
Removing internet exposure is an architectural programme, not a one-time patch, and the advisory is explicit that there is no CVE to wait for. Our Advisory Services — spanning programmatic security review, security program development and management, and Virtual CISO support — help CISOs and boards turn this advisory into a prioritised remediation plan, brief leadership with precision about what is confirmed versus inferred regarding attribution, and build the incident readiness to respond if targeting is found in their environment.
What are the Recommended Next Steps?
- Inventory PLC exposure immediately. Identify all internet-facing Rockwell, Schneider Electric, and Siemens devices, prioritising the specifically named models (CompactLogix, Micro850, BMX P34/Modicon M340, S7-1200 series).
- Query logs against the July 2026 IOCs. Cross-reference the newly published STIX indicators against traffic logs for ports 44818, 2222, 102, and 502, and port 22 on connected cellular modems.
- Remove direct internet exposure. Route all remote access through a secure gateway or jump host; do not rely on the device’s built-in access controls alone.
- Validate project file integrity. Compare running logic against known-good baselines using vendor integrity tools, with particular attention to Add-On Instructions (AOIs) and safety/alarm logic.
- Brief integrators and MSPs directly. Confirm that any third party with remote access to your OT environment is aware of this advisory and has reviewed their own access paths.
- Set controllers to RUN mode where physically possible, switching to program mode only for authorised maintenance windows.
Conclusion
The expansion of AA26-097A from a single-vendor warning to a multi-vendor advisory in just over three months is a signal in itself: this is an active, adapting campaign, not a contained incident. For CNI security leaders, the technical specifics matter less than the underlying pattern — internet-exposed OT, reached through legitimate engineering tools, is producing real operational and financial consequences. The organisations that treat this as a one-time patching exercise will likely see a third update to this advisory before the underlying exposure problem is solved.
If you would like to discuss how your organisation’s PLC and control-system exposure measures up against the activity described in this advisory, or how IOActive can support your OT/ICS resilience programme, we welcome the conversation.
References
[1] CISA, FBI, NSA, EPA, DOE, CNMF, Department of the Treasury. Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A), updated 22 July 2026. https://www.ic3.gov/CSA/2026/260722.pdf
[2] WaterISAC. CISA Updates Iranian-Affiliated PLC Targeting Advisory (AA26-097A), 22 July 2026. https://www.waterisac.org/tlpclear-cisa-updates-iranian-affiliated-plc-targeting-advisory-aa26-097a
[3] Censys. Iranian-Affiliated APT Targeting of Rockwell/Allen-Bradley PLCs, April 2026. https://censys.com/blog/iranian-affiliated-apt-targeting-rockwell-allen-bradley-plcs/
[4] Cybersecurity Dive. Nearly 4K industrial control devices vulnerable to Iran-linked hacking campaign, 10 April 2026. https://www.cybersecuritydive.com/news/critical-infrastucture-plcs-iran-hacking-censys/817209/
[5] CISA. IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities (AA23-335A). https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a
[6] IOActive. Compromising Industrial Facilities from 40 Miles Away (white paper). https://www.ioactive.com/wp-content/uploads/2018/05/IOActive_Compromising_Industrial_Facilities_from_40_Miles_Away.pdf
[7] IOActive (A. Bolshev, I. Yushkevich). SCADA and Mobile Security in the IoT Era. https://www.ioactive.com/scada-and-mobile-security-in-iot-era/
[8] M. Davis, IOActive. Advanced Metering Infrastructure (Smart Grid) Device Security, Black Hat USA 2009. https://blackhat.com/presentations/bh-usa-09/MDAVIS/BHUSA09-Davis-AMI-SLIDES.pdf