Joint advisory AA26-097A: Iranian-affiliated actors manipulating internet-exposed PLCs, 7 Apr 2026 (updated 22 Jul 2026)

What happened

• FBI, CISA, NSA, EPA, DOE, CNMF and Treasury: Iranian-affiliated APT actors seeking disruptive effects connected to exposed Rockwell CompactLogix/Micro850 and later Schneider Modicon M340 and Siemens S7-1200 PLCs in government, water and energy; exfiltrated project files, altered logic and AOIs, manipulated HMI/SCADA displays and disabled shutdown and alarm logic, causing disruption and financial loss in a few cases.
• Technique: vendor programming software from leased foreign infrastructure over ports 44818, 2222, 102, 502; Dropbear SSH on cellular modems.
• Attribution: the agencies; they reference prior CyberAv3ngers (IRGC-CEC) activity but do not explicitly attribute this campaign to it.

Sources

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.