cyber.hendryadrian.com
Security News · securityonline.info

U.S. Agencies Warn of Iranian-Affiliated Attacks on Internet-Exposed Rockwell PLCs

· Original article ↗

Summary

A U.S. agency advisory reports Iranian-affiliated actors compromising internet-exposed Rockwell PLCs, manipulating HMI/SCADA displays and disrupting operations. It urges operators to remove PLCs from public internet exposure and secure remote access.

Key points

  • A joint U.S. agency advisory reports Iranian-affiliated actors targeting internet-facing Rockwell Automation/Allen-Bradley PLCs.
  • The agencies say malicious interactions with project files and manipulation of HMI/SCADA displays have caused operational disruptions in Energy, Water and Wastewater, and Government Facilities.
  • The reported access method includes direct internet exposure and unauthorized connections using Studio 5000 Logix Designer.
  • The actors reportedly deployed Dropbear SSH on victim endpoints for remote access.
  • The advisory warns that targeting of ports 502 and 102 may indicate interest in other PLC brands, including Siemens S7; this is a potential targeting concern, not a confirmed impact.
  • Recommended steps include disconnecting PLCs from the public internet, routing remote access through secure gateways or jump hosts, setting supported controllers to Run, and monitoring relevant OT ports.

Article Details

Event Type
Ongoing cyber exploitation of internet-facing Rockwell Automation/Allen-Bradley PLCs by Iranian-affiliated actors.
Impact
The authoring agencies report PLC disruptions and financial losses across U.S. Energy, Water and Wastewater Systems, and Government Facilities. The activity involved manipulating PLC project files and HMI/SCADA displays to mask changes to industrial logic.

Threat Actors

CyberAv3ngersThe article identifies CyberAv3ngers as an IRGC-affiliated group and says it previously compromised at least 75 U.S.-based devices. The article says the current activity mirrors its historical campaigns; it does not explicitly attribute the current activity to the group.

Vendors

Rockwell Automationfederal agencies warn that Iranian-affiliated APT actors are compromising internet-facing Rockwell Automation/Allen‑Bradley PLCs to manipulate HMI and SCADA displays, causing operational disruptions across Energy,

Products

CompactLogixWhile the current focus is on Rockwell Automation devices like CompactLogix and Micro850, the agencies warn that the targeting of common ports like 502 and 102 suggests the actors may also be eyeing other brands, suchMicro850While the current focus is on Rockwell Automation devices like CompactLogix and Micro850, the agencies warn that the targeting of common ports like 502 and 102 suggests the actors may also be eyeing other brands, suchStudio 5000 Logix DesignerAttackers use leased overseas infrastructure and legitimate tools like Studio 5000 Logix Designer and Dropbear SSH to maintain access, and agencies urge immediate defensive actions such as disconnecting PLCs and using

Tools

Dropbear SSHAttackers use leased overseas infrastructure and legitimate tools like Studio 5000 Logix Designer and Dropbear SSH to maintain access, and agencies urge immediate defensive actions such as disconnecting PLCs and using

Countries

United StatesIn a major joint advisory released on April 7, 2026, a coalition of U.S.

Industries

EnergyPLCs to manipulate HMI and SCADA displays, causing operational disruptions across Energy, Water and Wastewater Systems, and Government Facilities.government facilitiesSCADA displays, causing operational disruptions across Energy, Water and Wastewater Systems, and Government Facilities.Water and Wastewater SystemsPLCs to manipulate HMI and SCADA displays, causing operational disruptions across Energy, Water and Wastewater Systems, and Government Facilities.

Related Articles