A Department of Justice employee put up a poster of the seven indicted hackers prior to a news conference for announcing a law enforcement action March 24, 2016 in Washington, DC. A grand jury in the Southern District of New York has indicted seven Iranian who were employed by two Iran-based computer companies that performed work on behalf of the Iranian Government, on computer hacking charges related to their involvement in an extensive campaign of over 176 days of distributed denial of service (DDoS) attacks.
Alex Wong/Getty Images
Seven U.S. federal agencies updated a landmark joint advisory on July 22, revealing that Iranian-affiliated hackers have expanded a months-long industrial control system campaign beyond Rockwell Automation equipment to actively target programmable logic controllers (PLCs) made by Siemens and Schneider Electric — and that the attackers are using those vendors’ own legitimate software to plant hidden code that disables safety alarms and replaces real sensor readings with falsified data on the screens operators depend on to keep infrastructure running.
At water treatment facilities, energy plants, and government installations across the country, operators have been watching dashboards that may have shown them normal conditions while attackers silently manipulated the underlying control logic. That is not a hypothetical risk. Advisory AA26-097A — co-signed by CISA, the FBI, the NSA, the EPA, the Department of Energy, U.S. Cyber Command’s Cyber National Mission Force, and the Department of the Treasury — confirms that organizations in those sectors experienced operational disruption and direct financial losses as a result of this activity, with the most recent indicators of compromise dated to this month.
The July 22 update matters specifically because it changes the threat’s profile from a Rockwell Automation problem to an industry-wide emergency. Rockwell, Siemens, and Schneider Electric together supply the majority of installed industrial automation systems in U.S. critical infrastructure. An adversary that can operate across all three vendor environments — using each company’s own engineering software — is not targeting a brand. It is targeting the entire category.
How Standard Security Tools Missed It: The Hidden Attack Method
The detail that makes this campaign structurally different from a conventional cyberattack is the attackers’ access method. To connect to a target PLC, the Iranian-affiliated actors did not deploy malware. They used Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ TIA Portal — the same software that legitimate engineers use every day — accessed via leased, overseas-hosted internet infrastructure and routed to PLCs that were directly reachable from the public internet.
Security researchers call this technique “living off the land” — weaponizing trusted, native tools rather than introducing detectable malicious files. When an attacker connects to a Rockwell PLC using Studio 5000, a network monitor sees what looks like an engineer doing their job. No malware signature fires. No antivirus alert triggers. The connection is legitimate in every technical sense except intent.
At Rockwell Automation controller sites, the attack was enabled by CVE-2021-22681, a critical authentication bypass vulnerability (CVSS 9.8) that stems from an insufficiently protected cryptographic key used to verify communications between Studio 5000 and Logix PLCs. An attacker who intercepts or obtains that key can impersonate the engineering software and connect directly to the controller without any valid credentials. Rockwell Automation has confirmed that this vulnerability cannot be addressed with a software patch — only architectural controls (network segmentation, physical key switch hardening, VPN-gated access) can close the gap.
Once connected, the actors exfiltrated PLC project files, then redeployed them with modifications. The July 22 update added new technical detail around Add-On Instructions (AOIs) — Rockwell-specific reusable code modules embedded within PLC programs. At one confirmed victim site, a malicious project file preserved all normal downstream control logic while silently inserting override routines that disabled shutdown sequences and alarm logic. The result: unsafe process conditions could develop in a facility without triggering any operator alert, and without leaving any trace that a conventional malware scan would catch.
The HMI and SCADA display manipulation is a separate and compounding attack layer. Beyond altering the underlying PLC logic, the attackers also changed what operators saw on their control room screens — replacing live sensor data with falsified readings that showed normal operating conditions. An operator watching a display showing safe pressure, temperature, or chemical levels has no way to know whether those numbers reflect reality or attacker-controlled fiction.
Ports Under Fire: How Attackers Got In
The advisory identified specific network protocol ports that attackers used to reach industrial devices. The list maps directly to the dominant communication standards in North American and European industrial automation.
Ports 44818 and 2222 are associated with EtherNet/IP — Rockwell Automation’s implementation of the Common Industrial Protocol over standard Ethernet, the dominant networking standard in North American manufacturing. Port 102 carries Siemens’ S7 communications protocol, the proprietary channel through which TIA Portal reaches Siemens hardware. Port 502 is Modbus TCP, a protocol designed in 1979 that has no authentication mechanism built in by design. Port 22 is SSH — including cases where attackers enabled Dropbear SSH on cellular modems attached to OT equipment, giving themselves a persistent remote command-and-control channel that could survive network changes.
The presence of these ports on internet-facing devices — whether through misconfiguration, deliberate remote-access architecture, or IT/OT network convergence that exposed previously isolated equipment — is the structural condition that the entire attack campaign depends on. None of the attacks described in the advisory required the actors to exploit a zero-day or defeat a sophisticated security control. They required only that the PLC was reachable from the internet.
Who Is Behind This: IRGC-CEC and the CyberAv3ngers Lineage
The advisory connects the 2026 campaign to the threat ecosystem behind CyberAv3ngers, a threat group that U.S. agencies have formally attributed to Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC). The U.S. Treasury Department sanctioned six named IRGC-CEC officials directing these operations in February 2024, and the State Department is offering up to $10 million for information on the group’s activities.
CyberAv3ngers has operated in four documented phases. Starting in November 2023, the group compromised at least 75 Unitronics Vision Series PLCs across the United States, United Kingdom, Israel, and Ireland by exploiting default credentials on internet-exposed devices — an attack that left residents of an Irish private water scheme without water for several days, and forced Pennsylvania’s Municipal Water Authority of Aliquippa to scramble to retake control of a booster station. In late 2024, the security firm Claroty’s Team82 identified IOCONTROL, a custom Linux malware platform built by the group that targets IP cameras, routers, HMIs, firewalls, and fuel management systems, using the MQTT protocol over TLS to blend its command-and-control traffic with legitimate internet-of-things network activity.
The current phase — active since March 2026 — represents a deliberate platform shift from Israeli-made Unitronics hardware to Western-made controllers from Rockwell, Siemens, and Schneider Electric, which are far more widely deployed across U.S. infrastructure. Cybersecurity firm Tenable assessed that the attack techniques have proliferated to an estimated 60 or more affiliated pro-Iranian hacktivist groups — meaning the threat persists regardless of what happens to the core CyberAv3ngers organization.
What Are Operators in Water, Energy, and Government Facilities Supposed to Do?
CISA’s central directive in the updated advisory is direct: disconnect PLCs and other operational technology assets from the public internet immediately. Every mitigation that follows from that point assumes the attacker cannot simply reach the PLC directly.
For facilities where some form of remote access is operationally required, the agencies specify that all external connectivity must be routed through VPNs with multi-factor authentication — not consumer-grade remote desktop tools, not direct port forwarding, not cellular modem SSH endpoints with default configurations. The advisory explicitly calls out Dropbear SSH on cellular modems as an attack vector and directs operators to disable unnecessary services.
On the protocol side, the agencies recommend blocking inbound connections to industrial protocol ports 44818, 2222, 102, 502, and 22 at the network perimeter for any device that has no operational reason to accept those connections from external addresses.
The July 22 update introduced guidance specific to the AOI stealth vector. Operators are directed to review and validate PLC project files for unauthorized changes, with particular attention to AOIs and reusable code modules that could conceal malicious logic. Offline, tested backups of all PLC logic and configuration files should be maintained and compared regularly against production copies — because if the comparison never happens, inserted malicious AOIs can persist indefinitely.
Physical controller protection modes — hardware key switches set to “run” mode — prevent remote modification of control logic even if an attacker has established an authenticated network connection to the device. This is a compensating control specifically for environments where network-layer mitigations cannot be fully implemented.
What the Expansion to Siemens and Schneider Means
The original April 2026 advisory could be read as a Rockwell Automation problem. Facilities running Allen-Bradley equipment needed to act; facilities running other vendors’ hardware could observe the situation with somewhat more distance.
The July 22 update removes that distance. With Siemens and Schneider Electric now confirmed in the targeted vendor list, the advisory effectively covers the dominant share of installed ICS equipment in U.S. critical infrastructure. Any internet-exposed PLC from any major vendor is now a confirmed target category for this campaign.
The Dragos 2026 OT/ICS Cybersecurity Year in Review assessed that Iranian adversaries have moved beyond pre-positioning — simply establishing presence in critical infrastructure networks — toward actively mapping control loops and understanding how to manipulate physical processes. The July 22 update’s documentation of malicious AOIs that disabled alarm and shutdown logic at a confirmed victim site is consistent with that assessment: the goal is not reconnaissance but physical consequence.
The full updated advisory — AA26-097A — including downloadable STIX-formatted indicators of compromise for SIEM, IDS, and firewall deployment, is available at CISA’s advisory page.
Frequently Asked QuestionsHow do Iranian hackers attack industrial control systems without anyone noticing?
The core technique in this campaign is using the vendors’ own legitimate engineering software — Rockwell’s Studio 5000, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ TIA Portal — to connect to PLCs over the internet. Because these tools are trusted and expected on OT networks, traditional malware detection and network intrusion systems do not flag the connections as suspicious. The attack also involves a separate but related method: manipulating the HMI and SCADA displays that operators use to monitor conditions, replacing real sensor data with falsified readings. An operator watching a dashboard showing safe conditions has no indication anything is wrong. Detection requires behavioral monitoring of PLC project file changes and baseline comparisons against known-good offline backups — not signature-based security tools.
Are Siemens and Schneider Electric PLCs vulnerable to the same flaw that affected Rockwell Automation?
The advisory does not specify a named CVE for the Siemens and Schneider Electric targeting — as of the July 22 update, the agencies confirmed observed targeting of those platforms but did not publicly detail the specific access mechanism used. For Rockwell Automation equipment, the documented vulnerability is CVE-2021-22681, a critical authentication bypass (CVSS 9.8) for which no vendor patch exists; only architectural mitigations apply. The common thread across all three vendor environments is that the PLCs were directly accessible from the public internet — which is the structural condition the advisory directs all operators to eliminate, regardless of vendor.
What should an operator at a water utility, energy facility, or government building do right now?
The advisory’s priority is to remove direct internet access from PLCs and OT devices immediately. Any external remote access that is operationally necessary must route through a VPN with multi-factor authentication. Block inbound connections on ports 44818, 2222, 102, 502, and 22 at the perimeter for any device that does not require them. Audit PLC project files for unauthorized changes to Add-On Instructions and reusable code modules — the vector used to hide alarm-disabling override code in at least one confirmed victim environment. Enable physical key switches on controllers to prevent remote logic modification. Download the STIX-formatted indicators of compromise from CISA advisory AA26-097A and deploy them in SIEM, IDS, and firewall platforms immediately.
Why can’t Rockwell Automation just patch CVE-2021-22681 so this stops?
Rockwell Automation has confirmed that CVE-2021-22681 cannot be fully resolved through a software patch. The vulnerability is in how the cryptographic key used to authenticate communications between Studio 5000 Logix Designer and Logix controllers is protected — a design condition that cannot be changed with an update without significant architectural changes to the controller communication model. The vulnerability was added to CISA’s Known Exploited Vulnerabilities catalog in March 2026, which triggers mandatory remediation timelines for federal agencies — but remediation here means implementing architectural controls (network isolation, VPNs, physical hardware locks), not deploying a patch update. Facilities that depend on standard patch-management workflows to close this exposure will remain vulnerable regardless of how current their other software is.