# Iran-Linked CyberAv3ngers (BAUXITE) Exploiting Internet-Exposed Rockwell, Schneider Electric, and Siemens PLCs Across US Water, Energy, and Government Infrastructure (CISA AA26-097A)

> An IRGC Cyber Electronic Command-affiliated actor tracked as CyberAv3ngers (Dragos: BAUXITE; Microsoft: Storm-0784; Mandiant: UNC5691) has, since at least March 2026, compromised internet-exposed Rockwell Automation, Schneider Electric, and Siemens PLCs across US Water and Wastewater Systems, Energy, and Government Facilities sectors, exfiltrating project files, tampering with ladder logic and Add-On Instructions, falsifying HMI/SCADA displays, and disabling shutdown/alarm functions. CISA, FBI, NSA, EPA, DoE, and US Cyber Command jointly issued advisory AA26-097A (April 7, 2026; updated July 22, 2026) documenting the campaign's central vulnerability, CVE-2021-22681 (CVSS 9.8, an unpatchable authentication-bypass in Rockwell Studio 5000/RSLogix 5000), expanding vendor scope, and adding detection guidance for malicious Add-On Instruction changes.

- **Published:** 2026-07-25T00:00:00Z
- **Last reviewed:** 2026-07-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1697
- **ID:** TL-2026-1697
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Actor:** Cyber Av3ngers (Iran)
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-22681

## Description

Since at least March 2026, an Iranian IRGC Cyber Electronic Command-affiliated actor publicly tracked as CyberAv3ngers — and overlapping substantially with Dragos-designated BAUXITE, Microsoft's Storm-0784, and Mandiant's UNC5691 — has conducted a sustained intrusion campaign against internet-exposed operational technology (OT) in the United States. The actor scans for and connects to Rockwell Automation/Allen-Bradley (CompactLogix, Micro850, and related Logix-family controllers), Schneider Electric (Modicon M340, BMX P34), and Siemens (SIMATIC S7-1200) programmable logic controllers reachable on commonly used OT ports — EtherNet/IP (44818), an alternate OT/configuration port (2222), Siemens S7comm/ISO-TSAP (102), and Modbus TCP (502) — as well as SSH (22) exposed via cellular modems. The predecessor to this campaign is CyberAv3ngers' November 2023 compromise of 75+ internet-exposed Unitronics PLCs using default credentials in the water sector.

The core technique-enabling vulnerability is CVE-2021-22681, a CVSS 9.8 authentication-bypass in Rockwell's RSLogix 5000 (v16-20) and Studio 5000 Logix Designer (v21+), caused by an insufficiently protected cryptographic key used to verify engineering-workstation-to-controller communication (CWE-522). Because the flaw is a design limitation rather than a patchable defect, Rockwell has stated it cannot be fully resolved via software update; CISA added it to the Known Exploited Vulnerabilities catalog on March 5, 2026 with a March 26, 2026 federal remediation deadline. Exploiting this bypass — or simply reaching devices left with default credentials or unrestricted internet exposure — lets the actor authenticate to Logix controllers as if it were a legitimate engineering workstation.

Once connected, the actor uses the vendors' own legitimate engineering software (Studio 5000 Logix Designer for Rockwell, EcoStruxure Control Expert for Schneider Electric, TIA Portal for Siemens) to extract PLC project files (Rockwell's .ACD format, containing ladder logic, Add-On Instructions, and configuration parameters), then modifies or deletes project logic — including reusable Add-On Instruction (AOI) code modules, per the July 22, 2026 advisory update's detection guidance — manipulates HMI/SCADA operator displays to mask true process state, and disables shutdown and alarm functions so that unsafe operational states persist without alerting operators. For persistent remote access, the actor deploys Dropbear, a lightweight open-source SSH server, on victim-adjacent infrastructure. Confirmed victims across the Water and Wastewater Systems, Energy, and Government Services and Facilities sectors have experienced real operational disruption and financial losses. A Censys scan around April 2026 identified 5,200+ internet-exposed Rockwell Automation controllers globally, roughly 3,900 of them in the United States, illustrating the scale of the attack surface.

CISA/FBI/NSA/EPA/DoE/US Cyber Command originally published joint advisory AA26-097A on April 7, 2026 with TTPs and 8 IP-address indicators of compromise tied to overseas hosting infrastructure. The July 22, 2026 update expanded the manufacturer scope beyond Rockwell to explicitly include Schneider Electric and Siemens, expanded the published machine-readable IOC set from 8 to 21 IP addresses, and added specific detection guidance for identifying malicious changes to reusable Rockwell Logix code modules (Add-On Instructions) by comparing running programs against known-good baselines.

This OT-focused campaign is occurring against the backdrop of a broader surge in Iran-affiliated offensive cyber activity following the February 2026 escalation of US-Iran-Israel military tensions. A related but operationally and attributionally distinct persona, Handala (also tracked as Void Manticore/Storm-0842/Banished Kitten, assessed with high confidence as MOIS-affiliated within the Banished Kitten ecosystem), has conducted separate, IT-focused destructive operations in the same period: a March 11, 2026 compromise of Stryker Corporation's Microsoft Intune administrator console that wiped roughly 200,000 enrolled devices across 79 countries (with ~50GB of data reportedly stolen), and a June 12, 2026 claimed breach of California Water Service (Cal Water) — publicly naming Bakersfield, Visalia, and Chico and claiming 5GB of exfiltrated billing data — which independent analysis found was limited to a GPS correction server and customer billing database, with no evidence of OT/ICS compromise. These incidents are documented here as corroborating context for the same Iran-aligned threat ecosystem's capability and escalating intent, not as direct evidence implicating CyberAv3ngers/BAUXITE in the Stryker or Cal Water intrusions.

## MITRE ATT&CK

- T1595 Active Scanning
- T1592 Gather Victim Host Information
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1219 Remote Access Tools
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1046 Network Service Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1041 Exfiltration Over C2 Channel
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1565 Data Manipulation
- T1489 Service Stop

## Sources

- [SecurityAffairs: Iran-linked actors breach and are targeting US water and energy control systems](https://securityaffairs.com/195991/apt/iran-linked-actors-breach-are-targeting-us-water-and-energy-control-systems.html)
- [CISA Advisory AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [WaterISAC: CISA Updates Iranian-Affiliated PLC Targeting Advisory (AA26-097A)](https://www.waterisac.org/tlpclear-cisa-updates-iranian-affiliated-plc-targeting-advisory-aa26-097a)
- [Picus Security: CISA Alert AA26-097A — Iranian-Affiliated Actors Target PLCs Across US Critical Infrastructure: Analysis, Simulation, and Mitigation](https://www.picussecurity.com/resource/blog/cisa-alert-aa26-097a-iranian-affiliated-actors-target-plcs-across-us-critical-infrastructure)
- [Rescana: Active Exploitation Alert — Iranian State-Sponsored Attacks Targeting Siemens, Schneider Electric, and Rockwell Automation ICS Devices](https://www.rescana.com/post/active-exploitation-alert-iranian-state-sponsored-attacks-targeting-siemens-schneider-electric-and-rockwell-automation-i)
- [1898 & Co. (Burns & McDonnell): July 2026 Update — Iran-Affiliated Threat Actors Targeting Critical Infrastructure Programmable Logic Controllers](https://1898advisories.burnsmcd.com/july-2026-update-iran-affiliated-threat-actors-targeting-critical-infrastructure-programmable-logic-controllers)
- [CISA ICS Advisory ICSA-21-056-03: Rockwell Automation Logix Controllers (Update A)](https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03)
- [NVD: CVE-2021-22681 Detail](https://nvd.nist.gov/vuln/detail/CVE-2021-22681)
- [Dragos: BAUXITE Threat Group Profile](https://www.dragos.com/threat/bauxite)
- [Tenable: CyberAv3ngers FAQ About Iran-Linked Threat Group Targeting U.S. Critical Infrastructure](https://www.tenable.com/blog/what-to-know-about-cyberav3ngers-the-irgc-linked-group-targeting-critical-infrastructure)
- [CybelAngel: Iranian Threat Actors Target US Critical Infrastructure](https://cybelangel.com/blog/iranian-threat-actors-target-us-critical-infrastructure/)
- [Industrial Cyber: Iran-linked Handala group targets Cal Water, exposing potential pathways between IT and OT environments](https://industrialcyber.co/utilities-energy-power-water-waste/iran-linked-handala-group-targets-cal-water-exposing-potential-pathways-between-it-and-ot-environments/)
- [SecurityAffairs: Iran-Linked Handala Breached a California Water Utility](https://securityaffairs.com/193565/uncategorized/iran-linked-handala-breached-a-california-water-utility-it-could-have-done-worse-and-it-knows-that.html)
- [TechCrunch: US government says Iran-linked hackers are disrupting American water and energy providers](https://techcrunch.com/2026/07/23/us-government-says-iran-linked-hackers-are-disrupting-american-water-and-energy-providers/)
- [Krebs on Security: Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker](https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1697