Iranian APTs Expand Targeting of US Water and Energy Sector PLCs: CISA Issues Urgent Update

Executive Summary

On July 24, 2026, a coalition of U.S. federal agencies, including CISA, the FBI, the NSA, and the Environmental Protection Agency (EPA), issued an urgent update to a joint cybersecurity advisory regarding ongoing Iranian-affiliated cyber activity. The report confirms that state-sponsored actors have expanded their targeting profile beyond previously observed Rockwell Automation devices to include Programmable Logic Controllers (PLCs) from Schneider Electric and Siemens. These operations primarily target the Water and Wastewater Systems (WWS), Energy, and Government Facilities sectors. The primary objective appears to be establishing persistent access to critical operational technology (OT) to facilitate potential future disruptive actions.

Threat Analysis

The threat landscape for critical infrastructure has shifted significantly over the last 48 hours as new evidence suggests a coordinated campaign to map and infiltrate North American OT environments. Intelligence suggests the actors, specifically the group known as CyberAv3ngers, are moving away from simple screen defacement—seen in late 2023—toward more sophisticated, stealthy reconnaissance. By targeting the fundamental logic controllers that manage valves, pumps, and power distribution, these actors are positioning themselves to cause physical operational failures. The expansion to Siemens and Schneider Electric equipment indicates a broadenening of the attack surface, likely seeking to exploit commonalities in how these devices are integrated into broader industrial networks.

Technical Details

The actors are leveraging internet-connected PLCs that lack robust authentication. Technical analysis of recent intrusions shows that the attackers are specifically scanning for and exploiting devices with open ports 502 (Modbus), 102 (S7comm), 2222 (EtherNet/IP), and 44818 (EtherNet/IP). A critical development in this campaign is the detected manipulation of reusable code modules. By injecting malicious logic into these modules, the actors ensure their presence persists even after routine maintenance or basic reboots. Furthermore, the actors are utilizing foreign-hosted IP addresses to proxy their traffic, making detection via traditional geographic fencing more difficult. The use of default credentials remains a primary entry vector, highlighting a persistent failure in basic OT security hygiene across smaller municipalities.

Attribution Assessment

With high confidence, U.S. intelligence attributes this activity to the Shahid Kaveh Group, a cyber threat actor affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC). The tactics, techniques, and procedures (TTPs) align with historical Iranian operations that prioritize strategic positioning over immediate financial gain. The selection of targets—often smaller, resource-constrained utilities—suggests a calculated attempt to find the 'path of least resistance' into the national infrastructure backbone.

Implications

The implications of this expanded targeting are severe. If these actors successfully maintain persistence within energy and water systems, they gain the capability to trigger localized outages or contaminate water supplies during periods of geopolitical tension. The focus on local municipalities suggests an attempt to create widespread, decentralized disruption that is harder for federal authorities to mitigate simultaneously. This activity signals that Iranian doctrine has fully integrated OT disruption as a viable tool for asymmetric warfare.

Recommendations

Encrygma recommends that OT operators immediately audit all internet-facing assets. Specifically:

1. Isolation: Remove all PLCs from direct internet exposure. Use secure gateways and VPNs with multi-factor authentication (MFA) for any necessary remote access.
2. Integrity Checks: Verify the integrity of all reusable code modules and logic programs against known-good backups.
3. Hardware Controls: For controllers with physical mode switches, ensure they are placed in the 'RUN' position to prevent unauthorized remote logic modifications.
4. Logging: Enable and monitor logs for ports 502, 102, 2222, and 44818, specifically looking for traffic originating from unauthorized or foreign IP ranges.