Cyber Operations — 2026-04-13

CISA, FBI, and NSA Warn Iranian APT Group Disrupting US Critical Infrastructure Through PLC Exploitation

An Iranian-affiliated advanced persistent threat group has been exploiting internet-facing Rockwell Automation PLCs across US critical infrastructure since at least March 2026, according to a joint advisory from CISA, FBI, NSA, EPA, DOE, and US Cyber Command. The group has caused operational disruptions including configuration wiping, sensor tampering, and HMI interference in government facilities, water systems, and energy sector targets. Thousands of Rockwell PLCs remain exposed online as the campaign continues.

Analysis
The joint advisory naming six federal agencies, including Cyber Command's Cyber National Mission Force, signals this is being treated as a national security threat, not just a cybersecurity incident. The operational disruptions reported suggest these attacks have moved beyond reconnaissance into active sabotage, consistent with Iranian doctrine of proportionate retaliation during conflict. The targeting of water systems and energy infrastructure maps to IRGC-linked groups' established pattern of selecting targets with maximum psychological impact on civilian populations.

1 sources

Thousands Of Rockwell PLCs Exposed Online As Iranian APT Threats Intensify - CyberPress