Federal Agencies Warn of Ongoing Attacks on PLCs in U.S. Critical Infrastructure

Jul 23, 2026 · Original article ↗

Summary

Federal agencies say attackers are exploiting internet-exposed PLCs across U.S. government, water, and energy sectors, using legitimate engineering software and manipulating operator displays. The updated advisory reports operational disruption and financial losses.

Key points

The July 2026 advisory expands affected PLC manufacturers beyond Rockwell Automation/Allen-Bradley to include Schneider Electric and Siemens.
Attackers scan for internet-exposed controllers and connect using legitimate engineering software and credentials, without relying on a software vulnerability.
The activity alters controller logic and, in some cases, operator displays to conceal changes from personnel.
Agencies report confirmed operational disruption and financial losses, unlike the largely disruption-free 2023 campaign.
The advisory adds guidance for detecting malicious changes hidden in reusable code modules.
Recommended steps include removing PLCs from direct internet access, securing remote access with MFA, checking logs for listed indicators, and maintaining offline backups.

Article Details

Event Type: Ongoing exploitation of internet-exposed programmable logic controllers (PLCs), involving changes to controller logic and, in some cases, operator displays.
Impact: The article reports confirmed operational disruption and financial loss for some affected organizations. Targeted sectors include U.S. government facilities, water systems, and energy infrastructure.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`ocferda[.]com`	Listed as a C&C server and in the article's C&C DNS-resolution query.
DOMAIN	`tylarion867mino[.]com`	Listed as a C&C server and in the article's C&C DNS-resolution query.
DOMAIN	`uuokhhfsdlk[.]tylarion867mino[.]com`	Listed as a C&C server and as a matching hostname in the article's C&C DNS-resolution query.
IPV4	`135[.]136[.]1[.]133`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`141[.]11[.]164[.]153`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`175[.]110[.]121[.]107`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`175[.]110[.]121[.]39`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`175[.]110[.]121[.]41`	Listed as a CISA-sourced indicator with detection label “Computers/Internet”; no more specific malicious role is stated.
IPV4	`175[.]110[.]121[.]42`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`185[.]225[.]17[.]225`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`185[.]82[.]73[.]162`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`185[.]82[.]73[.]164`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`185[.]82[.]73[.]165`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`185[.]82[.]73[.]167`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`185[.]82[.]73[.]168`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`185[.]82[.]73[.]170`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`185[.]82[.]73[.]171`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`185[.]82[.]73[.]175`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`192[.]142[.]54[.]79`	Listed as a CISA-sourced indicator with detection label “Computers/Internet”; no more specific malicious role is stated.
IPV4	`79[.]133[.]46[.]209`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`84[.]200[.]205[.]165`	Listed as a CISA-sourced indicator with detection label “Computers/Internet”; no more specific malicious role is stated.
IPV4	`88[.]80[.]150[.]199`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`88[.]80[.]150[.]200`	Listed as a C&C server in the CISA-sourced indicators.
IPV4	`88[.]80[.]150[.]202`	Listed as a C&C server in the CISA-sourced indicators.
SHA1	`366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb`	File hash listed with the detection name Backdoor.Linux.IOCONTROL.CIGBCBF.
SHA1	`95bd07b4400095acdafce05888da27228d7d07ca`	File hash listed with the detection name Trojan.Win64.MALPDB.A.