CISA, FBI, EPA and U.S. Government Partners Update Warning of Iran-Affiliated Threat Actors Targeting U.S. Critical Infrastructure Programmable Logic Controllers

FOR IMMEDIATE RELEASE
Wednesday, July 22, 2026
Contact: CISAMedia@cisa.dhs.gov 

CISA, FBI, EPA and U.S. Government Partners Update Warning of Iran-Affiliated Threat Actors Targeting Critical Infrastructure Programmable Logic Controllers

Provides updated actions to detect malicious activity, new observed PLC targeting, and additional mitigations

WASHINGTON - The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Environmental Protection Agency (EPA) and other U.S. government partners published an update today to a joint Cybersecurity Advisory, originally published in April 2026, Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers (PLC) Across US Critical Infrastructure. The advisory warns U.S. organizations of ongoing Iranian-affiliated cyber activity targeting internet-connected operational technology (OT) devices, provides indicators of compromise and detection guidance, and recommends mitigations to protect against this activity and strengthen resilience.

The update provides new guidance to detect malicious changes in reusable code modules used within Rockwell Automation PLC programs and adds more recommended mitigations. It also expands the manufacturer scope to include observed targeting of Schneider Electric, Siemens and possible other PLC manufacturers. The additional manufacturers being targeted emphasizes the importance for OT owners and operators to restrict direct internet access and ensure secure PLC deployment.

“CISA has consistently warned critical infrastructure stakeholders that Iranian-affiliated threat actors are conducting a range of targeted cyber activity to include compromise unsecure internet-connected accounts and devices,” said CISA Acting Executive Assistant Director for Cybersecurity Chris Butera. “CISA and our partners urge organizations to review this updated advisory and implement recommended actions to protect against this Iranian-affiliated threat activity.”

“Iranian cyber actors continue to target U.S. critical infrastructure, and the FBI is committed to identifying, disrupting, and imposing costs on those responsible,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “Sharing timely, actionable intelligence is a critical part of that work. This advisory provides network defenders with the information they need to identify malicious activity, strengthen their defenses, and reduce opportunities for Iranian cyber actors to disrupt the essential services Americans rely on.”

“Cybersecurity threats are a serious concern for our nation’s drinking water and wastewater systems, and these threats pose a legitimate risk to the communities, businesses, hospitals, schools, and other critical sectors that rely on these lifeline services,” said EPA Assistant Administrator for Water Jess Kramer. “EPA is committed to ensuring safe water for all Americans, and strengthening cybersecurity is key. EPA encourages water systems to be vigilant, stay informed, and work to adopt cybersecurity best practices.”

The Iranian-affiliated activity outlined in this advisory has disrupted PLCs across several U.S. critical infrastructure sectors by attempting to download malicious project files and manipulate data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss for affected organizations. The group of Iranian-affiliated actors targeted devices spanning multiple U.S. critical infrastructure sectors, including Water and Wastewater Systems, Energy and Government Services and Facilities, to include local municipalities.

Recommended mitigations are based on the activity described in the advisory to help organizations reduce the risk of compromise. The updated mitigations include:

• Review PLC manufacturer’s previously issued guidance to ensure security of OT deployments
• Strictly control network access to PLC devices
• Validate project files running PLCs for unauthorized changes
• Ensure service providers are informed of active threats targeting internet-connected PLC devices

CISA works closely with government and industry partners to provide actionable information that helps critical infrastructure owners and operators strengthen their security and resilience. For more information on nation-state cybersecurity advisories, visit Nation-State Cyber Threats.

###

About CISA