IC Technology & Cyber — 2026-07-23

CISA FBI and Cyber Command Update Joint Advisory on Iran-Affiliated Actors Exploiting Industrial Control Systems Across US Critical Infrastructure

BLUFExpansion of confirmed Iranian PLC targeting across three major manufacturers transforms this from a vendor-specific vulnerability into a systemic threat to US industrial control systems requiring sector-wide remediation.

CISA, the FBI, EPA and other federal partners on July 22 issued an update to an April advisory on Iran-affiliated cyber actors exploiting internet-connected programmable logic controllers across US critical infrastructure 1. The advisory attributes the activity to CyberAv3ngers, also tracked as the Shahid Kaveh Group, linked to Iran's IRGC Cyber Electronic Command, and is co-authored with NSA, the Department of Energy, Cyber Command's Cyber National Mission Force, and Treasury alongside CISA, FBI and EPA 1. The update expands manufacturer scope beyond Rockwell Automation/Allen-Bradley to include observed targeting of Schneider Electric and Siemens PLCs and adds guidance for detecting malicious changes in reusable code modules such as Add-On Instructions 12. CISA said the activity has disrupted PLCs across Water and Wastewater Systems, Energy, and Government Services and Facilities sectors, manipulating HMI and SCADA displays and causing operational disruption and financial loss 1. Updated mitigations call for restricting direct internet access to PLCs, securing cellular modems, validating project files for unauthorized changes, and informing service providers of active targeting 23. FBI Cyber Division Assistant Director Brett Leatherman and EPA Assistant Administrator for Water Jess Kramer joined CISA's Chris Butera in urging critical infrastructure operators to review and implement the advisory's recommendations 1.

Analysis
The update pushes CyberAv3ngers activity from a single-vendor problem into a cross-manufacturer one spanning Rockwell, Schneider Electric, and Siemens PLCs. Confirmed HMI/SCADA manipulation causing operational disruption and financial loss across water, energy, and government-facilities operators shows the campaign has moved past reconnaissance into effects with real consequences for service continuity. New guidance on detecting tampering in Add-On Instructions indicates the actors are burying persistence inside trusted reusable code rather than relying on external access alone, a technique harder to catch through perimeter monitoring. The broader vendor list could equally reflect wider detection reach across the ICS community rather than genuine escalation in targeting scope. Sourcing rests solely on CISA's own advisory, with trade press offering only secondary summarization.

3 sources

CISA, FBI, EPA and U.S. Government Partners Update Warning of Iran-Affiliated Threat Actors Targeting Critical Infrastructure Programmable Logic Controllers
CISA Updates Advisory on Iranian Cyber Actors Exploiting PLCs - Manufacturing Business Technology
Updated CISA advisory provides new guidance on Iran-affiliated threats to operational technology devices - Inside Cybersecurity