# Iranian IRGC CyberAv3ngers APT Campaign Targeting Rockwell/Allen-Bradley PLCs (CISA AA26-097A)

> Iranian-affiliated APT actors linked to IRGC Cyber Electronic Command (CyberAv3ngers/Storm-0784/Bauxite/UNC5691) are actively exploiting internet-exposed Rockwell Automation/Allen-Bradley PLCs using legitimate engineering software. Joint advisory AA26-097A issued by FBI, CISA, NSA, EPA, DOE, and U.S. Cyber Command on April 7, 2026, warns of PLC disruptions across U.S. Government, Water/Wastewater, and Energy sectors affecting over 5,219 globally exposed devices.

- **Published:** 2026-04-08T12:00:00Z
- **Last reviewed:** 2026-09-27T02:37:23.818Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0335
- **ID:** TL-2026-0335
- **Severity:** CRITICAL (CVSS 10)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Cyber Av3ngers (Iran)
- **Detections:** 9 · **IOCs:** 64 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-22681

## Description

Iranian IRGC Cyber Electronic Command (CEC)-affiliated threat group CyberAv3ngers has been conducting an active campaign since at least March 2026 targeting internet-exposed Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs) across U.S. critical infrastructure. The group uses leased overseas infrastructure running legitimate Rockwell configuration software — specifically Studio 5000 Logix Designer and RSLinx/FactoryTalk Linx — to establish accepted connections to victim PLCs without requiring zero-day exploitation.

The primary attack methodology leverages the inherent lack of authentication on internet-exposed EtherNet/IP (port 44818) interfaces. Once connected via legitimate engineering software, the actors interact with PLC project files, manipulate HMI and SCADA display data shown to operators, and disrupt controller operations. This approach is particularly insidious because the traffic appears as legitimate engineering communications, making detection extremely difficult without behavioral analysis.

Censys exposure analysis identified 5,219 internet-exposed hosts globally responding to EtherNet/IP on port 44818 and self-identifying as Rockwell Automation/Allen-Bradley devices. A critical 74.6% (3,891 hosts) are located in the United States, with heavy concentration on cellular carrier networks — Verizon Business (49.1%, 2,564 hosts) and AT&T Mobility (13.3%, 693 hosts) — indicating field-deployed devices at pump stations, substations, and municipal facilities using cellular modems for remote connectivity. The predominant model is MicroLogix 1400, many running end-of-sale firmware versions C/21.02 and C/21.07.

The operator infrastructure consists of a multi-homed Windows engineering workstation spanning 11 IP addresses (185.82.73.160–.171) in AS214036 (ULTAHOST, Amsterdam), active from January 2025 through March 2026. The workstation hostname DESKTOP-BOE5MUC was consistently leaked across all services via self-signed certificates. The machine runs Rockwell Studio 5000 Logix Designer, RSLinx/FactoryTalk Linx, WIBU CodeMeter license daemon, and a full Windows protocol stack. Censys identified four additional operator IPs (.160, .161, .163, .166) not listed in the original CISA advisory.

A secondary single-use staging box at 135.136.1.133 (AS9009, M247 Europe Romania) was provisioned on February 23, 2026, with a 19-day idle period before a brief 26-hour EtherNet/IP testing window around March 14-16, 2026, followed by a coordinated full teardown on March 17-18 — characteristic of single-use operational staging infrastructure.

Co-exposed services significantly amplify risk: 771 instances of VNC (direct HMI/SCADA display access), 280 Telnet sessions, 292 Modbus endpoints, and 256 Red Lion Crimson installations were identified alongside exposed PLCs. The advisory also notes probing of Modbus/TCP (port 502) and Siemens S7 (port 102) protocols, suggesting broader multi-vendor targeting intent beyond Rockwell devices.

This campaign represents an evolution of CyberAv3ngers' prior operations, including the November 2023 Unitronics PLC campaign (CISA AA23-335A) that compromised 75+ devices across U.S. water facilities, and the deployment of the custom IOCONTROL malware framework targeting IoT/OT devices with encrypted MQTT C2 and DNS-over-HTTPS capabilities. The group now coordinates through an "Electronic Operations Room" established February 28, 2026, directing 60+ pro-Iranian proxy groups using shared ICS exploitation techniques. Six IRGC-CEC officials were sanctioned by OFAC in February 2024 with a $10 million bounty.

## MITRE ATT&CK

- T0883 Internet Accessible Device
- T0819 Exploit Public-Facing Application
- T0821 Modify Controller Tasking
- T1692.001 Command Message
- T1694.001 Default Credentials
- T0836 Modify Parameter
- T0814 Denial of Service
- T0826 Loss of Availability
- T0829 Loss of View
- T0828 Loss of Productivity and Revenue
- T1595 Active Scanning
- T1596 Search Open Technical Databases
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1037 Boot or Logon Initialization Scripts
- T1027 Obfuscated Files or Information
- T1046 Network Service Discovery
- T1071 Application Layer Protocol
- T1568 Dynamic Resolution
- T1584 Compromise Infrastructure
- T1021 Remote Services
- T1505 Server Software Component
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1110 Brute Force
- T1213 Data from Information Repositories
- T1219 Remote Access Tools
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1565 Data Manipulation
- T1490 Inhibit System Recovery
- T0866 Exploitation of Remote Services
- T0843 Program Download
- T0858 Change Operating Mode
- T0878 Alarm Suppression

## Sources

- [CISA Advisory AA26-097A — Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [Censys — Iranian-Affiliated APT Targeting Rockwell/Allen-Bradley PLCs Exposure Analysis](https://censys.com/blog/iranian-affiliated-apt-targeting-rockwell-allen-bradley-plcs/)
- [CISA Advisory AA23-335A — IRGC-Affiliated Cyber Actors Exploit PLCs (Unitronics Campaign)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a)
- [Rockwell Automation PN1550 — CVE-2021-22681 Authentication Bypass in Logix Controllers](https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301)
- [Rockwell Automation SD1771 — Disconnect Devices from Internet and Harden PLCs](https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html)
- [MITRE ATT&CK — CyberAv3ngers Group Profile (G1027)](https://attack.mitre.org/groups/G1027/)
- [Claroty Team82 — Inside IOCONTROL: A New OT/IoT Cyberweapon](https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol)
- [SecurityWeek — Iran-Linked Hackers Disrupt US Critical Infrastructure via PLC Attacks](https://www.securityweek.com/iran-linked-hackers-disrupt-us-critical-infrastructure-via-plc-attacks/)
- [CyberWarrior76 — CyberAv3ngers IRGC-CEC Modus Operandi Analysis](https://cyberwarrior76.substack.com/p/cyberav3ngers-irgc-cec-affiliated)
- [CISA STIX Data — AA26-097A Machine-Readable Indicators](https://www.cisa.gov/sites/default/files/2026-04/AA26-097A.stix_.xml)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0335