Iranian APTs Target Multivendor PLC Ecosystem; CISA Warns of Modified Safety Logic in Water and Energy Sectors

Executive Summary

On July 22, 2026, and updated through July 27, 2026, a coalition of federal agencies including CISA, the FBI, NSA, and the Department of Energy released an urgent expansion to Joint Advisory AA26-097A. The update details a significant escalation in activity by Iranian-affiliated Advanced Persistent Threat (APT) groups targeting internet-exposed industrial control systems (ICS). Initially focused on Rockwell Automation devices, the campaign has now expanded to include critical hardware from Schneider Electric and Siemens. Most alarmingly, at least one confirmed U.S. victim has seen malicious modifications to PLC ladder logic designed to disable safety shutdown and alarm functions, potentially allowing unsafe physical conditions to develop without operator awareness.

Threat Analysis

The threat actors, primarily linked to the IRGC Cyber-Electronic Command (CEC) and the group known as CyberAv3ngers (or Shahid Kaveh Group), are targeting the operational backbone of the Water and Wastewater Systems (WWS), Energy, and Government Services sectors. Unlike typical ransomware, this campaign focuses on operational disruption and safety compromise. The actors leverage the inherent functionality of vendor engineering software to interact with Programmable Logic Controllers (PLCs). By accessing these devices, they can manipulate Human Machine Interface (HMI) displays to provide false data to human operators while simultaneously altering the underlying logic that governs physical processes like pump pressure, valve state, and emergency cut-offs.

Technical Details

The attack chain typically begins with the identification of internet-facing PLCs, often reachable via cellular modems or misconfigured industrial gateways. The actors use leased, third-party hosted infrastructure to connect to victim devices on standard OT ports, specifically TCP/44818 (EtherNet/IP), TCP/2222, TCP/102 (Siemens S7), and TCP/502 (Modbus).

Once connected, the actors utilize legitimate engineering software—including Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ TIA Portal—to exfiltrate PLC project files (MITRE ATT&CK T1041). The primary technical objective is the modification of 'ladder logic,' the specialized code that dictates how the PLC responds to sensor inputs. In recent incidents, the actors modified safety modules to ignore high-pressure or high-temperature thresholds, essentially blinding the safety Instrumented Systems (SIS) meant to prevent catastrophic failure.

Attribution Assessment

Intelligence communities maintain high confidence that this activity originates from the Iranian IRGC-CEC. The techniques, including the use of specific hosting providers and the focus on Israeli-linked or Western critical infrastructure, align with previous CyberAv3ngers operations observed in 2023 and early 2026. The shift toward multi-vendor exploitation suggests a refined capability aimed at maximizing regional impact regardless of the specific hardware provider.

Implications

The expansion of this threat to Siemens and Schneider Electric hardware significantly broadens the attack surface, as these vendors represent a massive portion of the global OT market. The ability to modify safety logic represents a 'kinetic-potential' threat, where a cyber event can lead to physical destruction or environmental hazards. Organizations relying on remote monitoring of unmanned facilities (e.g., pump stations or substations) are at the highest risk, as these environments often lack the robust network segmentation found in larger plant environments.

Recommendations

Encrygma analysts, in alignment with CISA, recommend the following immediate actions:

1. Zero Internet Exposure: Audit and remove all PLC and HMI devices from the public-facing internet. Any remote access must be brokered through a secure, multi-factor authenticated (MFA) VPN or a dedicated industrial jump host.
2. Physical Mode Switches: Where available, place the physical mode switch on PLCs into the 'RUN' position. This prevents remote modification of the project file regardless of network access.
3. Integrity Checks: Periodically validate the checksums and integrity of PLC project files against known-good backups. Any unexplained change in ladder logic should be treated as a high-priority security incident.
4. Port Monitoring: Configure firewalls to block all inbound traffic on ports 44818, 2222, 102, and 502 from unauthorized IP addresses, with specific focus on traffic originating from overseas hosting providers.