U.S. Agencies Warn of Iranian-Affiliated Actors Exploiting PLCs Across Critical Infrastructure
Summary
U.S. agencies report Iranian-affiliated actors have targeted internet-facing PLCs since at least March 2026, extracting project files and manipulating HMI/SCADA displays. Some organizations experienced operational disruption and financial loss.
Key points
- The agencies say the activity has affected organizations in Government Services and Facilities, Water and Wastewater Systems, and Energy.
- Targeted devices include Rockwell Automation/Allen-Bradley CompactLogix and Micro850 PLCs; other PLC brands may also be at risk.
- Actors used overseas-hosted infrastructure and Rockwell programming software to connect to exposed PLCs and extract project files.
- The FBI identified project-file extraction and manipulation of HMI and SCADA display data; some victims experienced disruption and financial loss.
- The advisory lists IP addresses observed communicating with PLCs and recommends checking logs for those indicators and suspicious traffic on ports including 44818, 2222, 102, 22, and 502.
- Recommended mitigations include removing PLCs from direct internet exposure, using secure gateways, placing supported controllers in run mode, enabling programming protections, and monitoring OT traffic.
Article Details
- Event Type
- Ongoing Iranian-affiliated cyber exploitation of internet-facing programmable logic controllers (PLCs) across U.S. critical infrastructure.
- Impact
- The authoring agencies report that actors accessed internet-facing PLCs, extracted project files, and manipulated data displayed on HMI and SCADA systems. Some affected organizations experienced operational disruption and financial loss. The agencies assess the activity is intended to cause disruptive effects; they identified it since at least March 2026.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 135[.]136[.]1[.]133 | IP address the FBI observed Iranian-affiliated APT actors using to communicate with targeted PLCs in March 2026. |
| IPV4 | 185[.]82[.]73[.]162 | IP address the FBI observed Iranian-affiliated APT actors using to communicate with targeted PLCs from January 2025 through March 2026. |
| IPV4 | 185[.]82[.]73[.]164 | IP address the FBI observed Iranian-affiliated APT actors using to communicate with targeted PLCs from January 2025 through March 2026. |
| IPV4 | 185[.]82[.]73[.]165 | IP address the FBI observed Iranian-affiliated APT actors using to communicate with targeted PLCs from January 2025 through March 2026. |
| IPV4 | 185[.]82[.]73[.]167 | IP address the FBI observed Iranian-affiliated APT actors using to communicate with targeted PLCs from January 2025 through March 2026. |
| IPV4 | 185[.]82[.]73[.]168 | IP address the FBI observed Iranian-affiliated APT actors using to communicate with targeted PLCs from January 2025 through March 2026. |
| IPV4 | 185[.]82[.]73[.]170 | IP address the FBI observed Iranian-affiliated APT actors using to communicate with targeted PLCs from January 2025 through March 2026. |
| IPV4 | 185[.]82[.]73[.]171 | IP address the FBI observed Iranian-affiliated APT actors using to communicate with targeted PLCs from January 2025 through March 2026. |
MITRE ATT&CK
T0883Actors used programming software to access and interact with publicly exposed, internet-accessible PLCs.T0885Actors communicated with PLCs over commonly used OT ports.T1219 · Remote Access ToolsActors deployed Dropbear SSH software on victim endpoints to enable remote access through port 22.T1565 · Data ManipulationActors interacted maliciously with PLC project files and altered data displayed on HMI and SCADA displays.
CVE
Threat Actors
APT IRANThe article says private industry and open sources use APT Iran as another name for CyberAv3ngers, which it links to prior PLC and HMI attacks; it does not identify this name as responsible for the current activity.BAUXITEThe article says private industry and open sources use Bauxite as another name for CyberAv3ngers, which it links to prior PLC and HMI attacks; it does not identify this name as responsible for the current activity.CyberAv3ngersThe article identifies CyberAv3ngers as an Iran's IRGC CEC-affiliated cyber threat actor that targeted U.S.-based PLCs and HMIs in similar activity beginning in November 2023. The article does not identify this group as responsible for the current activity.Mr. SoulThe article says private industry and open sources use Mr. Soul as another name for CyberAv3ngers, which it links to prior PLC and HMI attacks; it does not identify this name as responsible for the current activity.Soldiers of SolomonThe article says private industry and open sources use Soldiers of Solomon as another name for CyberAv3ngers, which it links to prior PLC and HMI attacks; it does not identify this name as responsible for the current activity.UNC5691The article says private industry and open sources use UNC5691 as another name for CyberAv3ngers, which it links to prior PLC and HMI attacks; it does not identify this name as responsible for the current activity.
Vendors
Rockwell Automationactors have been exploiting internet-facing programmable logic controllers (PLCs), particularly Rockwell Automation/Allen-Bradley devices, to extract project files and manipulate data on HMI and SCADA displays,Siemenstargeting devices manufactured by companies other than Rockwell Automation/Allen-Bradley, including the Siemens S7 PLC.
Products
CompactLogixIran-affiliated APT actors exploited internet-accessible PLCs—notably Rockwell Automation/Allen-Bradley CompactLogix and Micro850 controllers—since at least March 2026, causing disruptions across Government Services,Micro850APT actors exploited internet-accessible PLCs—notably Rockwell Automation/Allen-Bradley CompactLogix and Micro850 controllers—since at least March 2026, causing disruptions across Government Services, Water andSiemens S7 PLCdevices manufactured by companies other than Rockwell Automation/Allen-Bradley, including the Siemens S7 PLC.
Tools
Dropbear SSHInbound traffic and command channels targeted common OT ports (44818, 2222, 102, 22, 502); actors also deployed Dropbear SSH on victim endpoints to enable remote access via port 22.Studio 5000 Logix DesignerActors used leased overseas infrastructure and Rockwell programming software (e.g., Studio 5000 Logix Designer) to create accepted connections to target PLCs and extract project files.
Countries
IranIran-affiliated APT actors exploited internet-accessible PLCs—notably Rockwell Automation/Allen-Bradley CompactLogix and Micro850 controllers—since at least March 2026, causing disruptions across Government Services,United Statesdata on HMI and SCADA displays, causing operational disruption and financial loss across multiple U.S.
Industries
Energyat least March 2026, causing disruptions across Government Services, Water and Wastewater Systems, and Energy sectors.Government Services and FacilitiesSectors: Government Services and Facilities, Water and Wastewater Systems (WWS), and Energy Water and Wastewater Systemscontrollers—since at least March 2026, causing disruptions across Government Services, Water and Wastewater Systems, and Energy sectors.