CISA 2026-04-07

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

Machine-generated analysis · WAYSCloud LLM

Iranian-affiliated actors are targeting internet-facing PLCs to manipulate HMI/SCADA displays and cause operational disruption. The advisory specifies Rockwell Automation/Allen-Bradley PLCs are known targets, but notes potentially other brands may be affected.

Context

The advisory describes activity by Iran-affiliated APT actors targeting internet-facing operational technology devices, specifically programmable logic controllers. The stated impact includes manipulation of data on human-machine interface and SCADA displays, leading to operational disruption and financial loss. The activity has been observed across several U.S. critical infrastructure sectors.

Operator considerations

Check: Inventory for internet-facing PLCs, particularly Rockwell Automation/Allen-Bradley devices
Isolate: Remove PLCs from direct internet exposure using secure gateways and firewalls
Log: Monitor ports 44818, 2222, 102, and 502 for traffic, especially from overseas hosting providers

From Cybersecurity and Infrastructure Security Agency ↗

Advisory at a Glance

Title

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

Original Publication

April 7, 2026

Executive Summary

Iran-affiliated advanced persistent threat (APT) actors are conducting exploitation activity targeting internet-facing operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley. This activity has led to PLC disruptions across several U.S. critical infrastructure sectors through malicious interactions with the project file and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.

U.S. organizations should urgently review the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) i...

Read the full advisory on CISA →