U.S. Agencies Warn of Iranian-Linked Attacks on Exposed Rockwell PLCs
Summary
U.S. agencies say Iranian-linked groups have targeted internet-exposed Rockwell PLCs since March 2026, extracting project files and manipulating HMI/SCADA displays. Censys found 3,891 such exposed hosts in the U.S.
Key points
- A joint U.S. agency advisory says Iranian state-backed groups have targeted Rockwell Automation/Allen-Bradley PLCs since March 2026.
- The FBI identified project-file extraction and manipulation of HMI and SCADA displays; agencies reported operational disruptions and financial losses.
- Censys found 5,219 internet-exposed Rockwell/Allen-Bradley hosts responding to EtherNet/IP globally, including 3,891 in the United States.
- Censys said many U.S. hosts were on cellular carrier networks, suggesting some are field-deployed devices using cellular modems.
- Recommended defenses include disconnecting PLCs from the internet or placing them behind firewalls, enforcing MFA, patching devices, disabling unused services, and monitoring logs and OT-port traffic.
Article Details
- Event Type
- Cyberattacks targeting internet-exposed Rockwell Automation/Allen-Bradley PLCs in U.S. critical infrastructure networks
- Impact
- Federal agencies reported operational disruptions and financial losses, as well as extraction of PLC project files and manipulation of HMI and SCADA displays.
Threat Actors
CyberAv3ngersThe article says this group, affiliated with Iran’s IRGC, compromised at least 75 Unitronics PLC devices in attacks between November 2023 and January 2024.HandalaThe article describes this hacktivist group as linked to Iran’s Ministry of Intelligence and Security and reports that it wiped approximately 80,000 devices on Stryker’s network.
Vendors
Rockwell AutomationIranian-linked state-backed hackers have targeted thousands of Internet-exposed Rockwell Automation/Allen-Bradley PLCs since March 2026, causing operational disruptions and financial losses in U.S.UnitronicsRevolutionary Guard Corps (IRGC) and tracked as CyberAv3ngers targeted vulnerabilities in U.S.-based Unitronics operational technology (OT) systems.
Products
Allen-Bradley PLCsIranian-linked state-backed hackers have targeted thousands of Internet-exposed Rockwell Automation/Allen-Bradley PLCs since March 2026, causing operational disruptions and financial losses in U.S.Unitronics PLCsCyberAv3ngers hackers compromised at least 75 Unitronics PLC devices in multiple waves of cyberattacks between November 2023 and January 2024, with half of those in Water and Wastewater Systems critical infrastructure
Countries
Iranorganizations have recently escalated, likely in response to hostilities between Iran, and the United States and Israel,” the authoring agencies warned.United StatesIranian-linked state-backed hackers have targeted thousands of Internet-exposed Rockwell Automation/Allen-Bradley PLCs since March 2026, causing operational disruptions and financial losses in U.S.