Get on Slack/Teams RSS
Last updated: August 19, 2026 at 1:47 AM UTC
All 741 Vulnerability 286 Breach 129 Threat 319 Defense 7
Tag: plc (2 articles)Clear
threat
2026-07-27

US agencies say Iran-linked actors are disrupting water and energy control systems

CISA, the FBI, NSA, EPA, and Department of Energy updated a joint advisory warning that Iran-affiliated actors are exploiting internet-facing operational technology across US critical infrastructure, and in some cases disrupting it. Since at least March 2026 the group has targeted programmable logic controllers, the small industrial computers that run automation processes, extracting device project files and then modifying or deleting the control logic. Water, wastewater, energy, and government facilities are among the affected sectors, and some victims experienced operational disruption and financial loss. The July update broadened the range of affected device makers, added detection guidance, and refreshed the published indicators of compromise.

iran-aptics-otplccritical-infrastructurewater-energy
Check
Take internet-facing PLCs and operational technology offline or behind a VPN, change default and weak device passwords, and check for unexpected changes to control logic and project files.
Affected
Water, wastewater, energy, and government operators with internet-exposed programmable logic controllers; attackers extract project files and alter control logic, which can push processes into unsafe states.
Fix
Remove operational technology from direct internet exposure, enforce strong unique credentials and multi-factor authentication, segment control networks, back up device logic offline, and apply the advisory's detection guidance and indicators.
threat
2026-04-07

FBI and CISA warn Iranian hackers are targeting internet-exposed Rockwell PLCs at US water and energy facilities

A joint FBI/CISA advisory warns that Iranian-affiliated APT actors are actively targeting internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers across US critical infrastructure - specifically Government Services, Water and Wastewater Systems, and Energy sectors. The attacks have caused financial losses and operational disruptions since March 2026, with the FBI confirming attackers extracted PLC project files and manipulated data displayed on HMI and SCADA systems. The escalation is linked to ongoing hostilities between Iran, the US, and Israel.

iranicsplcrockwellcritical-infrastructurefbicisawaterenergy
Check
If you operate or support organizations with industrial control systems, check whether any Rockwell/Allen-Bradley PLCs are directly exposed to the internet.
Affected
Organizations running internet-exposed Rockwell Automation and Allen-Bradley PLCs, particularly in water treatment, energy, and government facilities. Any PLC reachable from the public internet without VPN or network segmentation is at risk.
Fix
Remove all PLC management interfaces from internet exposure immediately - these should only be accessible via dedicated OT networks or VPN. Change all default credentials on PLCs and HMI systems. Monitor for unauthorized access to PLC project files and unexpected changes to HMI/SCADA displays. Follow the joint advisory's indicators of compromise and detection signatures.