IC Technology & Cyber — 2026-07-26

CISA FBI NSA Update Advisory as Iranian Hackers Breach US Water and Energy PLCs Disabling Safety Alarms

BLUFTehran's vendor-agnostic ability to disable safety logic on exposed PLCs converts every internet-reachable water or energy controller into a physical-safety risk, with additional compromises likely by late October.

CISA, the FBI, NSA, and Department of Energy updated a joint advisory Wednesday (AA26-097A, first issued in April) warning that Iranian-affiliated actors are targeting internet-exposed programmable logic controllers across US water, energy, and government services infrastructure 12. The update expands the target set beyond Rockwell Automation/Allen-Bradley controllers to Schneider Electric Modicon M340 and Siemens S7-1200 devices 1. Attackers accessed PLCs through exposed OT ports (44818, 2222, 102, 502) and SSH, then used vendor engineering software including Rockwell's Studio 5000 Logix Designer, Schneider's EcoStruxure Control Expert, and Siemens' TIA Portal to exfiltrate and alter project file logic and manipulate HMI/SCADA displays 3. At one victim, the FBI found hackers had disabled shutdown and alarm functions, allowing unsafe conditions without alerting operators; the agencies say the activity, underway since at least March, has caused operational disruption and financial loss at multiple sites 23.

Analysis
The vendor-agnostic expansion to Schneider and Siemens controllers indicates Tehran's operators have generalized their technique for reaching internet-exposed OT regardless of manufacturer, so remediation tied to one vendor's patches no longer contains the threat. Disabling shutdown and alarm logic without alerting operators pushes the risk from data manipulation to physical safety at any facility leaving PLCs reachable from the internet, and pairs with the concurrent SS7 and ad-tech targeting of US military personnel as a second Iranian vector running through commercial infrastructure outside Defense Department control. The broadened vendor list could instead reflect improved federal detection and attribution rather than genuine tradecraft expansion. Confidence is low given reliance on a single advisory cycle, AA26-097A, with Security Affairs, Cybersecurity Dive, and TechCrunch offering convergent but derivative accounts rather than independent confirmation; defenders should treat any internet-facing PLC as exposed regardless of make.

4 sources

CISA, FBI warn that Iran-linked hackers are expanding target set for water, energy - Cybersecurity Dive
US government says Iran-linked hackers are disrupting American water and energy providers - TechCrunch
Iran-Linked Actors Breach Are Targeting US Water and Energy Control Systems - Security Affairs
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure (AA26-097A) - CISA (joint advisory with FBI, NSA, EPA)