Listen to this Post
Introduction: A Silent Cyber Battlefield Is Expanding
Critical infrastructure has become one of the most attractive targets for nation-state cyber operations. While ransomware and data breaches often dominate headlines, attacks against industrial control systems (ICS) have the potential to create far more serious consequences, including disruptions to electricity, water treatment, manufacturing, and government services. Unlike traditional cyberattacks that focus on stealing information, these operations are designed to manipulate physical processes, placing both infrastructure and public safety at risk.
A newly updated joint advisory from multiple U.S. federal agencies highlights an escalating cyber campaign attributed to Iranian-affiliated threat actors. The warning demonstrates how sophisticated adversaries are shifting their attention toward internet-exposed programmable logic controllers (PLCs), using legitimate engineering software to silently alter industrial processes while hiding their actions from system operators.
Federal Agencies Issue Urgent Warning Over Iranian PLC Attacks
The FBI, CISA, NSA, EPA, Department of Energy (DOE), U.S. Cyber Command’s Cyber National Mission Force (CNMF), and the Treasury Department have jointly released an updated cybersecurity advisory warning organizations about an ongoing Iranian-affiliated cyber campaign targeting internet-accessible industrial control systems.
According to the advisory, the attacks have already affected organizations operating within government facilities, water and wastewater treatment plants, and energy infrastructure. Multiple victims reportedly suffered operational disruptions alongside measurable financial losses.
Officials believe the campaign is intended to create disruptive effects inside the United States and has intensified amid increasing geopolitical tensions involving Iran, the United States, and Israel.
Summary of the Threat Campaign
The advisory explains that the attackers have been actively compromising exposed PLCs since at least March 2026.
Rather than exploiting highly advanced zero-day vulnerabilities, the threat actors often rely on exposed industrial devices that remain directly accessible from the internet. After gaining access, they use legitimate engineering software to retrieve project files, modify industrial logic, and upload altered configurations back into production systems.
This technique allows attackers to change how industrial equipment behaves while maintaining the appearance of normal operation on operator dashboards.
Which Industrial Controllers Are Being Targeted?
The updated advisory expands previous reporting and identifies several major industrial automation platforms being targeted:
Rockwell Automation Allen-Bradley CompactLogix PLCs
Rockwell Automation Micro850 PLCs
Schneider Electric Modicon M340 (BMX P34)
Siemens S7-1200 PLCs
Federal agencies also caution that many additional internet-connected industrial controllers could be vulnerable if they remain publicly accessible.
How the Attack Works
Instead of deploying destructive malware immediately, attackers first gather engineering project files directly from industrial controllers.
Using legitimate software such as:
Rockwell Studio 5000 Logix Designer
Schneider EcoStruxure Control Expert
Siemens TIA Portal
they download existing PLC configurations exactly as legitimate engineers would.
Once obtained, the attackers modify ladder logic, remove protective functions, and insert malicious instructions before uploading the altered projects back into the controllers.
Because legitimate engineering tools are used throughout the intrusion, malicious activity can blend into normal maintenance operations.
Manipulating SCADA and HMI Displays
Perhaps the most dangerous aspect of the campaign is the manipulation of Human Machine Interface (HMI) and Supervisory Control and Data Acquisition (SCADA) displays.
Operators depend on these interfaces to monitor industrial equipment in real time.
The attackers reportedly modified displayed values so that operators continued seeing normal operating conditions even while physical equipment behaved differently.
This creates an extremely dangerous situation where pumps, valves, motors, generators, or chemical processes may enter unsafe operating conditions without triggering immediate operator intervention.
Safety Logic Was Specifically Targeted
Federal investigators documented one particularly concerning incident where attackers uploaded a malicious PLC project that intentionally preserved enough legitimate ladder logic to keep production running.
Hidden inside the project, however, were additional instructions overriding safety parameters designed to maintain safe operating conditions.
As a result:
Critical shutdown logic could be bypassed.
Safety alarms could be disabled.
Dangerous operating thresholds could be ignored.
Equipment damage could occur before personnel recognize the issue.
This demonstrates a level of operational understanding rarely seen outside highly capable nation-state actors.
Rockwell Add-On Instructions (AOIs) Became a Key Target
Investigators observed attackers modifying Rockwell Automation Add-On Instructions (AOIs).
AOIs are reusable software components similar to function blocks used throughout industrial automation projects.
Because these modules are often trusted and reused across multiple systems, compromising them allows malicious logic to spread throughout industrial environments without immediately attracting attention.
Federal agencies recommend carefully comparing AOIs currently deployed inside PLCs with verified engineering backups.
Industrial Network Services Under Attack
The attackers focused on several industrial communication services commonly exposed to external networks.
Observed targeting included services associated with:
EtherNet/IP
Modbus TCP
Siemens S7 communications
Connected industrial modem services
Internet-facing PLC programming interfaces dramatically increase the likelihood of compromise if proper segmentation and authentication are absent.
Campaign Linked to CyberAv3ngers
The activity closely resembles operations previously attributed to CyberAv3ngers, also known as the Shahid Kaveh Group.
Security agencies associate this threat group with
Previous operations linked to the group have targeted water utilities and industrial organizations using similar disruption-focused tactics rather than traditional espionage objectives.
The updated advisory suggests this campaign represents a continuation of those efforts using increasingly sophisticated techniques.
Indicators of Compromise (IOCs)
Federal agencies released several newly identified indicators associated with the campaign.
Observed IP Addresses
185.82.73[.]175
141.11.164[.]153
175.110.121[.]42
These indicators should remain defanged when shared publicly and only be re-enabled within trusted threat intelligence platforms or internal security tooling.
Deep Analysis
The latest advisory highlights an important evolution in industrial cyber warfare. Rather than exploiting obscure firmware vulnerabilities, the attackers abuse legitimate engineering workflows. This approach is effective because many organizations focus heavily on malware detection while paying far less attention to authorized engineering actions.
Recommended Defensive Commands
Identify Internet-Exposed ICS Services
nmap -Pn -sV -p 102,502,2222,44818 <target-range>
Search Firewall Logs for PLC Programming Activity
grep -Ei "44818|502|102|2222" firewall.log
Monitor Suspicious Connections
tcpdump -i eth0 port 44818 or port 502 or port 102
List Active Network Connections
netstat -antp
Capture Industrial Traffic
tshark -i eth0
Verify PLC Project Integrity
sha256sum project_backup.acd sha256sum running_project.acd
Recommended Security Measures
Remove PLCs from direct internet exposure.
Require VPN access with multi-factor authentication for engineers.
Compare running PLC logic against offline trusted backups.
Audit every engineering workstation.
Monitor uploads performed through engineering software.
Enable immutable configuration backups.
Separate ICS networks from enterprise IT infrastructure.
Continuously monitor industrial protocols for unusual activity.
Regularly review Add-On Instructions (AOIs) for unauthorized modifications.
Develop recovery procedures capable of restoring validated PLC logic quickly after compromise.
What Undercode Say:
The newest advisory reinforces a cybersecurity lesson that defenders have repeated for years: internet-exposed industrial systems remain one of the weakest points in critical infrastructure security. While organizations often invest heavily in endpoint protection and cloud security, operational technology environments frequently lag behind due to legacy equipment, limited maintenance windows, and operational constraints.
What makes this campaign particularly alarming is not the sophistication of malware but the abuse of trusted engineering workflows. By using legitimate vendor software, attackers significantly reduce the likelihood of triggering traditional security controls. This technique transforms normal maintenance operations into potential attack vectors.
Another concerning aspect is the deliberate manipulation of HMI and SCADA displays. Deceiving operators is far more dangerous than simply shutting down equipment. If engineers believe pressure, temperature, or flow rates remain within safe limits while actual values exceed operational thresholds, the resulting damage could be catastrophic.
The campaign also illustrates the growing convergence between geopolitical conflict and cyber operations. As international tensions increase, industrial infrastructure becomes an attractive target because disrupting utilities or manufacturing can create economic and psychological effects without requiring conventional military action.
Organizations should also recognize that internet exposure is only part of the problem. Weak remote access policies, poor password management, shared engineering accounts, and outdated firmware collectively increase the attack surface. Even a well-configured firewall cannot compensate for weak operational security practices.
Industrial asset inventories remain incomplete in many organizations. Security teams cannot protect devices they do not know exist. Comprehensive asset discovery and continuous monitoring should therefore become foundational security priorities.
Engineering workstations deserve the same level of protection as domain controllers or privileged administration systems. Because they possess the ability to modify PLC logic, compromising a single engineering laptop can provide attackers with broad operational control.
Routine integrity verification of PLC programs should become standard practice. Comparing running logic with validated golden configurations can quickly reveal unauthorized modifications before they escalate into operational incidents.
The targeting of reusable code modules such as AOIs also demonstrates the importance of secure software lifecycle practices within industrial automation. Code reviews, digital signatures, and configuration version control are no longer optional—they are becoming essential defensive capabilities.
Looking ahead, defenders should expect threat actors to increasingly automate PLC reconnaissance, credential harvesting, and logic manipulation using artificial intelligence. AI-assisted attacks may reduce the time required to identify vulnerable industrial environments while increasing the precision of malicious modifications.
The advisory ultimately serves as a reminder that cybersecurity is no longer limited to protecting data. In operational technology environments, cyberattacks can directly influence physical processes, making collaboration between IT security teams and operational engineers more critical than ever.
✅ Confirmed: Multiple U.S. federal agencies jointly released an updated advisory warning about Iranian-affiliated targeting of internet-exposed PLCs within critical infrastructure sectors.
✅ Confirmed: The advisory identifies targeting of Rockwell Automation, Schneider Electric, and Siemens PLC platforms, with attackers using legitimate engineering software to alter PLC project files and manipulate HMI/SCADA displays.
✅ Confirmed: The warning links the activity to Iranian-affiliated operations resembling CyberAv3ngers and recommends removing internet exposure, validating PLC logic, monitoring engineering activity, and strengthening industrial network defenses. The broader assessment of geopolitical motivation is based on intelligence analysis rather than publicly disclosed technical proof, but it aligns with the agencies’ stated assessment.
Prediction
(+1) Critical infrastructure operators will accelerate investment in industrial cybersecurity, including network segmentation, continuous PLC integrity monitoring, engineering workstation protection, and zero-trust remote access. At the same time, ICS vendors are likely to introduce stronger authentication, signed PLC logic verification, and enhanced anomaly detection features, making future attacks that rely on legitimate engineering tools significantly more difficult to execute.
▶️ Related Video (72% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.stackexchange.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
