US agencies warn that Iran-linked actors are disrupting industrial controllers, then widen the warning
July 22, 2026 (Published April 7, updated July 22, 2026)
A joint advisory from US agencies including CISA, the FBI, NSA and EPA, first published April 7, said Iranian-affiliated actors were exploiting internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers (PLCs) and disrupting US organizations in government services, water and energy, with disruptions since at least March. A July 22 update added detection guidance for malicious changes to reusable code modules in PLC programs, and said activity against ports used by Schneider Electric and Siemens equipment suggests opportunistic targeting of other vendors. Researchers link the activity to CyberAv3ngers, a group tied to Iran's IRGC.
Why it matters
The advisory covers the whole period. It turned an alert about one vendor's products into a warning about any internet-reachable controller.
What defenders can take from it
- Take controllers off the internet, or put them behind a VPN with multi-factor authentication.
- Change default passwords and use the advisory's detection guidance on PLC program changes.