Sign In
Iranian-Affiliated Actors Target U.S. Critical Infrastructure Through PLCs
Back to top
August 10, 2026
Anatomy of an Attack
Iranian-Affiliated Actors Target U.S. Critical Infrastructure Through PLCs
On April 7, 2026, CISA and partner agencies published Joint Cybersecurity Advisory AA26-097A, describing an Iranian-linked campaign against Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs). The advisory’s July 22, 2026 update not only confirmed the campaign’s expansion to two more major PLC vendors, but revealed the adversary’s on-target escalation to disabling shutdown and alarm logic.
Between July 26 and 27, just four days later after the AA26-097A update, a coordinated attack hit more than 30 Minnesota community water and wastewater systems. Some of the Minnesota cities disclosed that their ‘automation control functions’ were affected. In one case, the City of Braham took its water plant offline after attackers successfully shut down the well and water treatment plant operating controls.
The operational methods observed align with those of CyberAv3ngers, an Iranian-linked IRGC Cyber Electronic Command; however sophisticated adversaries from Iran, China, and Russia frequently focus their efforts on compromising PLCs and broader critical infrastructure. Despite these similarities, definitive attribution for the Minnesota incidents remains unconfirmed as of July 30.
These campaigns highlight a security gap where monitoring permitted OT protocols or relying strictly on vendor native logging is not enough on its own. Adversaries are using legitimate engineering tools over approved ports. Uncovering these operations requires continuous, passive network detection and response (NDR), such as ExtraHop’s RevealX, that analyzes protocol-level transactions in real time, correlates cross-segment behavior, and flags subtle operational anomalies that firewalls and static rules miss.
The Iranian PLC Cyberattack Lifecycle
Phase 1: Discovering and Selecting Internet-Exposed PLCs
Iranian-affiliated threat groups actively focus on internet-exposed [T0883] controllers by weaponizing native vendor engineering platforms, such as Rockwell Automation Studio 5000, Schneider Electric EcoStruxure, and Siemens TIA Portal. These administrative suites are essential for configuring, programming, and overseeing industrial logic and safety controls. By compromising a workstation hosting these tools, adversaries gain the authoritative privileges of an engineer. This trusted access is then leveraged to conduct reconnaissance, manipulate PLC ladder logic, disable safety parameters, falsify telemetry, circumvent interlocks, and deploy malicious or outdated firmware.
The actors stage their administrative suites on actor-controlled leased-VPS infrastructure. Because they leverage legitimate, native engineering platforms rather than custom malware or exploits, their activities appear as authorized operations. By targeting standard PLC management ports (TCP 44818, 2222, 102, and 502) and using port 22 [T0885] for cellular modem access, the attackers effectively weaponize these expected pathways, ensuring their unauthorized access remains indistinguishable from legitimate maintenance traffic.
Legitimate remote engineering originates from authorized internal subnets or managed jump hosts. Port numbers alone cannot confirm legitimacy, as the actors deliberately used standard vendor service ports. External connections from hosting providers contacting PLCs is a high-confidence sign of unauthorized activity. RevealX flags new external peers establishing direct connections to internal/OT assets without going through authorized jump hosts or VPN gateways.
Phase 2: Remote Access Through PLC Protocols and Cellular Modems
The actors targeted ports associated with several OT vendors, suggesting opportunistic rather than single-vendor selection. In one reported incident, the actors used Dropbear SSH [T1219] over TCP/22 for remote access through a victim cellular modem.
The modem access expands the detection surface. An internet-facing cellular modem may be the only path to a remote pump station, substation, or field controller. Once that modem becomes an access point, traffic can enter the OT segment without traversing the organization’s primary IT perimeter.
Potential network indicators include newly observed SSH-capable modems, inbound TCP/22 sessions from unusual external sources, abrupt changes in SSH session frequency, or long-lived connections outside normal management patterns. Where session keys or credentials are managed, RevealX can decrypt SSH traffic in real time to provide full visibility into interactive commands and transferred files.
Phase 3: Exfiltrating PLC Project Files
The actors used the legitimate engineering software to retrieve PLC project files and transfer them to external actor-controlled servers [T1041]. PLC project files contain the dependencies that define how the controller actually behaves (ladder logic, tags, alarms, and configurations).
The transfer can resemble a legitimate project upload from a controller to an engineering workstation. However, network traffic directionality and context differentiate legitimate work from exfiltration. A PLC pushing project files directly to an unrecognized IP address represents an operational anomaly. Once an external host collects a project file, any subsequent download from that same unrecognized host to the controller should be treated as highly suspicious.
Phase 4: Manipulating PLC Logic and Critical Safety Functions
Once the actors have the PLC’s blueprints, they are able to impact the critical systems they control. The threat actors were able to modify and delete [T1565] PLC logic, including Add-On Instructions, as well as manipulation of HMI and SCADA display data. In one victim, a malicious project overrode instructions that maintained safe operating parameters while maintaining downstream ladder-logic functions. The changes disabled critical shutdown and alarm logic, creating the possibility of unsafe conditions without notifying the operators [T0829].
This approach reduces the value of a simple uptime check. A controller may remain online and continue enough process logic to appear functional while select safeguards or displays have changed. By establishing dynamic behavioral baselines for OT protocols (such as CIP, Modbus TCP, and S7comm), RevealX detects unauthorized programming commands, configuration downloads, and remote mode changes as they occur across the network.
Detect the Behavior: MITRE ATT&CK to ExtraHop Mapping
Defensive Implications and Network Detection Capabilities
This campaign demonstrates access through trusted operational management paths rather than traditional endpoint-to-endpoint pivots. Because legitimate engineering work and malicious campaigns share the same applications, ports, and protocols, security teams must correlate multiple telemetry streams to isolate malicious sessions.
A single indicator, such as an engineer working late or connecting via a cloud host, on its own cannot confirm an attack. However, risk escalates rapidly when multiple contextual signals converge:
- Direct communication from a public or hosting-provider IP to a field modem or PLC.
- SSH sessions originating from unauthorized external peers.
- Project file transfers occurring outside scheduled maintenance windows.
- Follow-on OT protocol write commands modifying controller configuration or alarm logic.
ExtraHop RevealX delivers passive, line-rate visibility across L2–L7 protocol layers without agents or performance degradation. By automatically discovering and classifying OT assets, tracking peer-to-peer communication baselines, and performing deep packet inspection on industrial protocols, RevealX gives security teams the immediate context (source, destination, session timing, byte volume, and protocol specifics) needed to isolate unauthorized sessions before operational safety is compromised.
Recommended Defensive Actions
- Eliminate Direct PLC Exposure: Remove PLCs from the public internet. Route all remote administration through access gateways enforcing multi-factor authentication and role-based access control.
- Audit and Secure Field Connectivity: Integrate remote cellular modems into central security monitoring. Enable local logging, audit active SSH configurations, and disable default administrative accounts.
- Validate Controller Logic Against Baselines: Perform logic comparisons across running project files, Add-On Instructions, I/O maps, and alarm configurations using known-good offline backups. Always verify backup integrity prior to device restoration.
- Enforce Hardware and Software Protections: Lock physical keyswitches on PLCs to RUN mode during standard operations to prevent unauthorized logic downloads. Switch controllers to PROGRAM or REMOTE mode only during scheduled maintenance.
- Correlate Cross-Domain Telemetry: Combine NDR connection records with cellular modem logs, jump host audit trails, and SCADA alarm records to hunt for unauthorized engineering sessions.
Resources:
CISA: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
Cyber News Network Substack: https://cyberwarrior76.substack.com/p/iranian-linked-plc-exploitation-and
ExtraHop: https://www.extrahop.com/blog/a-heightened-alert-for-critical-infrastructure
ExtraHop: https://www.extrahop.com/blog/the-digital-front-of-iranian-cyber-offensive-and-defensive-response
Itauditlabs: https://itauditlabs.com/episode/critical-infrastructure-everything-is-connected-and-vulnerable/
IOActive: https://www.ioactive.com/iranian-affiliated-actors-expand-plc-targeting-to-siemens-and-schneider-electric-what-cisas-updated-advisory-means-for-cni/
SecurityWeek: https://www.securityweek.com/dozens-of-minnesota-water-utilities-targeted-in-coordinated-ot-attacks/
Discover more
Senior Cyber Threat Intelligence Analyst
Angela Wilson is a Senior Cyber Threat Intelligence Analyst with over a decade of experience in the cybersecurity industry. She focuses on transforming complex threat data into strategic intelligence that enhances organizational resilience and informs proactive defense.
Share
Key Takeaways
- Iranian Threat Actors: Adversaries are weaponizing native PLC engineering platforms to target U.S. critical infrastructure, including water systems, by leveraging legitimate, trusted management pathways.
- Weaponizing Trusted Access: Attackers exploit internet-exposed PLCs and cellular modems to gain administrative control, effectively masking unauthorized activity as legitimate maintenance traffic on standard vendor ports.
- Current Monitoring Gaps: Relying solely on vendor logging is insufficient, as adversaries use authorized protocols and tools, requiring advanced visibility to detect subtle operational anomalies.
- Effective Network Defense: Continuous, passive NDR solutions like ExtraHop RevealX provide essential real-time visibility, identifying unauthorized programming commands and configuration changes that traditional security tools miss.
- Recommended Security Actions: Eliminate direct internet exposure, validate logic baselines against known-good backups, and correlate cross-domain telemetry to detect unauthorized engineering sessions before safety is compromised.
