U.S. widens warning on Iranian hackers sabotaging PLCs to Siemens and Schneider devices
U.S. agencies on July 22 expanded an advisory on Iranian-affiliated hackers tampering with programmable logic controllers, adding Schneider Electric and Siemens devices to a campaign first described in April against Rockwell Automation equipment.
PLCs run pumps, valves and other physical equipment in water systems, energy facilities and municipal services. The advisory says the attackers did more than deface screens: at one victim, malicious logic overrode instructions that keep equipment within safe operating limits, and shutdown and alarm logic was disabled.
What the advisory says
The FBI, CISA, NSA, the Environmental Protection Agency, the Department of Energy, U.S. Cyber Command's Cyber National Mission Force and the Treasury Department first published advisory AA26-097A on April 7. Law firm Robinson+Cole noted at the time that the PLC disruptions caused operational disruption and financial loss across several U.S. critical infrastructure sectors.
According to the advisory, the actors reached internet-exposed controllers, used vendor configuration software to exfiltrate project files, then modified or deleted project logic, including reusable code blocks known as Add-On Instructions, and manipulated HMI and SCADA displays. Affected devices include Rockwell Automation/Allen-Bradley CompactLogix and Micro850, Schneider Electric BMX P34 and Modicon M340, and Siemens S7-1200 controllers, along with cellular modems running Dropbear SSH. Targeted sectors include local governments, water and wastewater systems, and energy.
The advisory does not name the group behind the current campaign, describing it only as Iranian-affiliated. It cites a similar 2023 campaign by CyberAv3ngers, a group linked to Iran's Islamic Revolutionary Guard Corps, which compromised at least 75 Unitronics devices.
The July update added guidance on detecting malicious changes to Rockwell programs, broadened the scope to other PLC vendors and added indicators of compromise.
The Canadian angle
No Canadian agency co-signed the advisory, and it reports U.S. victims. But Canadian utilities and municipalities use the same controllers. The Communications Security Establishment's 2025-2026 annual report says the Cyber Centre issued two bulletins on Iranian cyber threats to Canada during the year, including one tied to the response to U.S. and Israeli strikes in February 2026.
What to do
- Remove PLCs from direct internet exposure and route remote access through a secure gateway or jump host.
- Restrict controller access with firewall rules, and consider blocking hosting-provider IP ranges.
- Set controllers with a physical key switch to run mode, and compare running logic against known-good copies.
- Change default passwords, require multi-factor authentication for external OT access and secure cellular modems.
- Watch for unusual traffic on ports 44818, 2222, 102, 502 and 22, especially from foreign hosting providers.
