FBI CISA NSA Warn Iranian Threat Actors Actively Exploiting US Critical Infrastructure PLCs
Joint advisory AA26-097A was published April 7 by six agencies: FBI, CISA, NSA, EPA, DOE, and US Cyber Command. Threat actors are linked to Iran's
The false-operator-display technique, where operators see normal readings while malicious control logic executes, marks a capability escalation from the December 2023 Aliquippa compromise, where simpler Unitronics default-credential exploitation left no comparable detection gap. Per a single Picus Security analysis of the AA26-097A advisory, detection signatures now exist for Dropbear SSH persistence, PLC project file extraction, and SCADA HMI manipulation, techniques the six-agency advisory described only at the advisory level without defender-actionable specificity. Whether CyberAv3ngers escalate from access maintenance to destructive attack within 90 days is uncertain, given demonstrated multi-platform capability, active exploitation since at least March 2026, and ongoing U.S.-Iran military conflict. The sustained access may instead reflect long-term intelligence collection against infrastructure, consistent with Chinese APT operations against comparable targets where access is held for years without escalation, though the wartime context reduces that precedent's force. Alongside other Iran reporting from this cycle, the IRGC's concurrent internal security operations and external cyber activity illustrate the breadth of Iranian intelligence operations under wartime conditions.
1 sources
- CISA Alert AA26-097A Analysis Simulation and Mitigation -
Picus Security