Six Federal Agencies Warn Iranian APT Is Exploiting Rockwell PLCs Across US Water Systems

FBI, CISA, NSA, EPA, DOE, and US Cyber Command published a joint advisory warning that an Iranian-affiliated APT group has been exploiting internet-facing programmable logic controllers, primarily Rockwell Automation devices, at US drinking water and wastewater systems since at least March 2026. The actors manipulated configuration files, showed false data on dashboards, and caused operational disruptions and financial losses. Censys researchers identified 5,219 exposed Rockwell PLCs online, mostly in the US.