CISA and FBI Alert: Iranian Cyber Actors Expand Attacks on Water and Energy Sector PLCs

Executive Summary

On July 22, 2026, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the Environmental Protection Agency (EPA) issued a significant update to their ongoing advisory concerning Iranian-affiliated threat actors. These groups have intensified their targeting of internet-connected operational technology (OT) devices, specifically programmable logic controllers (PLCs), across multiple critical infrastructure sectors including water, wastewater, and energy. Unlike previous opportunistic scans, recent activity shows intentional manipulation of industrial processes on US soil, marking a dangerous escalation in cyber-physical targeting.

Threat Analysis

The threat actors, identified as linked to the Iranian Government—specifically clusters associated with the IRGC—are moving beyond simple credential harvesting to active operational disruption. The campaign focuses on exploiting unsecure internet-connected accounts and devices with a recent, significant expansion in technical scope. Initially targeting Rockwell Automation/Allen-Bradley units, the actors have now successfully engaged devices from Schneider Electric and Siemens. Their current objective appears to be pre-positioning and the execution of disruptive actions meant to coincide with heightening geopolitical tensions between the US, Israel, and Iran.

Technical Details

Tactical observations indicate the use of several foreign-based IP addresses to access internet-facing PLCs. The attackers utilize legitimate manufacturer PLC programming and engineering software to connect to misconfigured victim devices. Specific technical behaviors include the downloading of malicious project files directly to targeted PLCs and the manipulation of data on Human-Machine Interface (HMI) and Supervisory Control and Data Acquisition (SCADA) displays. Key ports identified as primary targets include TCP 44818 (EtherNet/IP), 2222, 102 (Siemens S7), and 502 (Modbus), alongside port 22 for modems. Of particular concern in the latest update is the observed exploitation of reusable code modules in PLC programs to hide malicious logic from standard integrity checks.

Attribution Assessment

Intelligence officials attribute this campaign to Iranian-affiliated Advanced Persistent Threat (APT) actors. The Tactics, Techniques, and Procedures (TTPs) align with previously observed behaviors from the 'CyberAv3ngers' or IRGC-linked groups. The shift from opportunistic access to the deliberate download of malicious project files indicates a higher degree of operational maturity and intent to cause physical-world consequences, typical of Iranian state-sponsored cyber-physical sabotage units that have previously targeted regional adversaries.

Implications

The targeting of Schneider and Siemens devices significantly broadens the attack surface for municipal utilities that may have diversified their hardware since the initial warnings in early 2024. The ability to manipulate HMI displays poses a severe safety risk, as operators may be blinded to the actual physical state of equipment—such as tank levels or chemical dosing rates—leading to overflows or water contamination. For small to medium-sized municipalities, the cost of forensic recovery and system remediation after a project file breach is substantial, often requiring the full replacement of control hardware.

Recommendations

CISA and the FBI urgently recommend that all critical infrastructure operators: 1. Audit and remove all PLCs and HMIs from direct internet exposure, placing them behind a secure firewall or VPN. 2. Implement Multi-Factor Authentication (MFA) for all remote access points to prevent credential-based entry. 3. Validate project files currently running on PLCs against known-good gold copies to detect unauthorized logic changes or malicious code modules. 4. Change all default passwords and rotate credentials for industrial control software and associated modems immediately to disrupt current persistence mechanisms.