CISA and FBI Escalate Warning as Iranian Actors Expand Critical Infrastructure Attacks on Siemens and Schneider PLCs

Executive Summary

On July 22, 2026, the Cybersecurity and Infrastructure Security Agency (CISA), in coordination with the FBI and the Environmental Protection Agency (EPA), released a critical update to its ongoing investigation into Iranian-affiliated cyber operations. The advisory warns of a significant expansion in the targeting of operational technology (OT) by threat actors linked to the Iranian regime. Previously focused on specific manufacturers like Rockwell Automation, the attackers have broadened their scope to include industrial control components from Siemens and Schneider Electric. These intrusions have already resulted in operational disruptions within the U.S. water and energy sectors, marking a heightened phase of cyber-physical warfare intended to project power beyond regional borders.

Threat Analysis

The current campaign reflects a strategic shift by Iranian state-sponsored groups toward high-impact, low-complexity attacks on critical infrastructure. By targeting internet-facing Programmable Logic Controllers (PLCs), these actors seek to achieve maximum psychological and operational impact with minimal technical overhead. Intelligence indicates that these operations are often timed to coincide with geopolitical escalations in the Middle East, specifically regarding maritime security in the Strait of Hormuz. The primary objective appears to be the creation of leverage through the threat of infrastructure sabotage, targeting essential services that affect public safety and economic stability. Unlike traditional espionage, these attacks are designed to be visible and disruptive, serving as a form of digital signaling in the context of broader asymmetric conflict.

Technical Details

The observed activity involves the exploitation of default credentials and known vulnerabilities in internet-connected PLCs and Human-Machine Interfaces (HMIs). Once access is gained, the actors engage in "malicious project file interactions," where they download unauthorized configuration files to the controllers. This allows them to manipulate data on HMI and Supervisory Control and Data Acquisition (SCADA) displays, providing false readings to operators or disabling safety protocols entirely. The updated advisory highlights that attackers are now using advanced techniques to obfuscate their command-and-control (C2) traffic, frequently routing through domestic U.S. IP addresses to bypass geographic filtering and evade detection by traditional perimeter defenses. Specific targeting of Schneider Electric's Unity Pro and Siemens' TIA Portal environments has been noted in recent forensic captures.

Attribution Assessment

Intelligence agencies attribute these operations with high confidence to threat actors operating on behalf of the Iranian Government, specifically the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence and Security (MOIS). While the regime often utilizes proxy groups or "hacktivist" fronts to maintain plausible deniability, the sophisticated coordination between these cyber efforts and Iran's broader kinetic military posture confirms state direction. Overlaps in infrastructure and tradecraft with previously documented groups like CyberAv3ngers and Emennet Pasargad further solidify the link to Tehran’s centralized cyber warfare apparatus. The shift toward diverse hardware targets suggests a maturing capability to weaponize varied industrial protocols.

Implications

The move to target Siemens and Schneider Electric hardware significantly broadens the potential victim pool, as these systems are ubiquitous in global manufacturing and utility management. The compromise of water and wastewater systems poses immediate risks to public health, while incursions into the energy sector could lead to localized grid instability. Furthermore, this campaign signals that Iranian doctrine has fully integrated cyber-physical disruption as a primary tool for asymmetric warfare, suggesting that further escalations against NATO-allied infrastructure are likely if regional tensions persist. The vulnerability of legacy OT systems, often left unpatched or exposed for decades, remains the most significant systemic risk to national security.

Recommendations

CISA and the FBI strongly urge all OT operators to immediately audit their networks for internet-facing PLCs and HMI devices. Recommendations include: 1) Disconnecting all industrial controllers from the public-facing internet and implementing secure, firewalled gateways; 2) Enforcing multi-factor authentication (MFA) for all remote access points to the OT environment; 3) Implementing rigorous monitoring of SCADA logs for unauthorized configuration changes; and 4) Applying all vendor-specific security patches for Siemens, Schneider Electric, and Rockwell Automation hardware. Organizations should treat any unauthorized access to their OT layer as a critical national security incident and report it immediately to the local FBI field office or CISA’s 24/7 Operations Center.