US Agencies Warn of Iranian-Linked Attacks on Internet-Exposed PLCs
Summary
U.S. agencies warn that Iranian-affiliated actors have targeted internet-exposed Rockwell/Allen-Bradley PLCs since March 2026, extracting project files and manipulating HMI/SCADA displays; reported impacts include financial losses and operational disruption.
Key points
- A joint advisory from the FBI, CISA, NSA, EPA, DOE and U.S. Cyber Command warns of Iranian-affiliated APT actors targeting internet-exposed Rockwell/Allen-Bradley PLCs.
- The FBI says the activity included extracting PLC project files and manipulating data displayed on HMI and SCADA systems.
- Agencies report that attacks against multiple U.S. critical infrastructure sectors have caused financial losses and operational disruptions since March 2026.
- Recommended measures include disconnecting PLCs from the internet or firewalling them, updating firmware, disabling unused services and default authentication keys, and using multifactor authentication for OT access.
- A previous 2023 advisory warned of CyberAv3ngers targeting Unitronics OT systems; the article says at least 75 PLC devices were compromised between November 2023 and January 2024.
Article Details
- Event Type
- Iranian-affiliated APT actors targeting internet-exposed Rockwell/Allen-Bradley PLCs at U.S. critical infrastructure organizations; the FBI assesses the activity is intended to cause disruption.
- Impact
- The advisory reports financial losses and operational disruptions since March 2026, as well as extraction of PLC project files and manipulation of data displayed on HMI and SCADA systems.
Threat Actors
CyberAv3ngersThe article reports that CyberAv3ngers compromised at least 75 Unitronics PLC devices between November 2023 and January 2024, and describes the group as affiliated with the Iranian Government Islamic Revolutionary Guard Corps (IRGC).HandalaThe article describes Handala as an Iranian-linked, pro-Palestinian hacktivist group and reports that it wiped approximately 80,000 devices on Stryker's network.
Products
Rockwell/Allen-Bradley programmable logic controllers (PLCs)Iranian-linked hackers are targeting internet-exposed Rockwell/Allen-Bradley programmable logic controllers (PLCs) on U.S.Unitronics PLCsPrevious campaigns include CyberAv3ngers targeting Unitronics PLCs and Handala wiping devices at Stryker.
Countries
Industries
Energya joint advisory authored by the FBI, CISA, NSA, the Environmental Protection Agency (EPA), Department of Energy (DOE), and the United States Cyber Command – Cyber National Mission Force (CNMF).Government Services and Facilitiescritical infrastructure sectors (including Government Services and Facilities, Water and Wastewater Systems, and Energy), and have resulted in financial losses and operational disruptions since March 2026.Water and Wastewater Systemscritical infrastructure sectors (including Government Services and Facilities, Water and Wastewater Systems, and Energy), and have resulted in financial losses and operational disruptions since March 2026.