IC Technology — 2026-07-24

Seven US Agencies Update Joint Advisory on Iranian Cyber Actors Targeting Critical Infrastructure PLCs With New Detection Guidance

BLUFExpanding the advisory from one PLC vendor to three confirms Iranian cyber operators have industrialized their intrusion tradecraft into a cross-platform capability targeting engineering workflows, not just perimeter gaps.

CISA, the FBI, EPA and other US and international partners revised the joint advisory "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure," first issued in April, with an update released Wednesday 1. The revision adds guidance for detecting and mitigating malicious changes to reusable code modules in Rockwell Automation/Allen-Bradley PLC programs and expands the list of affected manufacturers to include Schneider Electric and Siemens 123. According to the advisory, Iranian-affiliated actors have disrupted PLCs across water, wastewater, energy and government-facility sectors using techniques including downloading malicious project files, manipulating HMI and SCADA displays, and exfiltrating files through third-party remote command-and-control channels while bypassing security alarms, resulting in operational disruption and financial loss for affected organizations 1. Updated mitigations call on operators to restrict PLCs from direct internet exposure, use secure gateways and firewalls, change default passwords and monitor project files for unauthorized changes, per statements from CISA Acting EAD for Cybersecurity Chris Butera, EPA Assistant Administrator Jess Kramer and FBI Cyber Division Assistant Director Brett Leatherman 1.

Analysis
The revision reframes the threat from a single-vendor issue to a cross-platform pattern, treating Rockwell, Schneider Electric and Siemens as facing identical intrusion techniques rather than isolated incidents, and its focus on reusable code modules rather than perimeter controls indicates investigators traced compromises into engineering workflows where malicious logic can persist across firmware updates and device swaps. Sourcing rests entirely on CISA's own advisory, with trade outlets merely summarizing rather than corroborating independently, and the expanded manufacturer list may equally reflect wider baseline monitoring and improved attribution tooling rather than a genuine broadening of Iranian-affiliated targeting. Operators across water, wastewater, energy and government facilities face renewed pressure to segment PLCs from direct internet exposure and audit project files for tampering, since the update ties expanded scope to confirmed operational disruption and financial loss rather than theoretical risk.

6 sources

CISA and Partners Revise Iranian-Affiliated PLC Threat Advisory - AFCEA International
Federal Agencies Update Warning on Iranian Cyber Actors Targeting PLCs - ExecutiveGov
Agencies issue updated advisory on Iranian cyber actors targeting programmable logic controllers - American Hospital Association
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A) - CISA
Iranian Hackers Targeting Siemens and Schneider Electric Industrial Control Systems - Infosecurity Magazine
Federal agencies broaden alert on Iran-linked OT attacks - The Record from Recorded Future News