Threat reportAPTTL-2026-3319
Centrii: Nation-State Pre-Positioning (Volt Typhoon, IRGC-Affiliated PLC Exploitation) and Renewable Supply-Chain Risk Raise Energy Sector Exposure
Centrii: Nation-State Pre-Positioning (Volt Typhoon (TL-2026-3319), also tracked as AA26-097A, is a high-severity advanced persistent threat campaign, first published 2026-10-11. It is attributed to Volt Typhoon - G1017 (China, Iran) with high confidence, affects Rockwell Automation Allen-Bradley CompactLogix / Micro850 PLCs, maps to 13 MITRE ATT&CK techniques (T1003.003, T1021.001, T1027.002), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 13MITRE ATT&CK
- Actors
- 2Volt Typhoon - G1017
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-3319
- Threat ID
- TL-2026-3319
- Also known as
- AA26-097A, AA24-038A, Centrii GRIDLOCK
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- Volt Typhoon - G1017, IRGC-affiliated CyberAv3ngers
- Attribution confidence
- HIGH
- Nation-state nexus
- China, Iran
- Motivation
- DESTRUCTION
- Target sectors
- energy, utilities, water-wastewater, government administration, communications, transport, critical-infrastructure
- Target regions
- North America, Europe, united kingdom
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Centrii: Nation-State Pre-Positioning (Volt Typhoon
Malware and tooling: Dropbear SSH, FRP - S1144, Rockwell Studio 5000 Logix Designer
How Centrii: Nation-State Pre-Positioning (Volt Typhoon works
Centrii analysis (2026-10-01, reported by Industrial Cyber 2026-10-06) describes converging energy-sector threats: Volt Typhoon living-off-the-land footholds in U.S. critical infrastructure, Iranian-affiliated exploitation of internet-facing PLCs (CISA AA26-097A), Russian-attributed physical sabotage in Europe, and supply-chain risk from grid-connected inverters and batteries. Utility ransomware incidents rose sharply in Q1 2026.
This record is strategic context built from a secondary analysis (Centrii, covered by Industrial Cyber on 2026-10-06) and anchored to two primary government advisories that the analysis relies on. The article itself states no CVEs, malware, or IOCs; the technical content below comes from the primary advisories.
China-linked Volt Typhoon: CISA/NSA/FBI advisory AA24-038A (2024-02-07) assesses with high confidence that Volt Typhoon is pre-positioning on IT networks of Communications, Energy, Transportation Systems and Water/Wastewater organizations to enable lateral movement to OT assets and disruption. Access has persisted for at least five years in some victims. The actor relies on living-off-the-land tooling (PowerShell, WMI, netsh portproxy, ntdsutil, vssadmin, wevtutil) with valid credentials, extracts NTDS.dit repeatedly, uses Fast Reverse Proxy (FRP) clients (UPX-packed), and routes C2 through compromised end-of-life Cisco and NETGEAR SOHO routers (KV botnet) and multi-hop proxies. Centrii assesses the intent as enabling disruption rather than intelligence gathering.
Iranian-affiliated PLC exploitation: joint advisory AA26-097A (published 2026-04-07, updated 2026-07-22) by FBI, CISA, NSA, EPA, DOE and U.S. Cyber Command reports Iranian-affiliated APT actors, previously associated with the IRGC Cyber Electronic Command and the CyberAv3ngers persona, exploiting internet-facing PLCs (Rockwell CompactLogix and Micro850, Schneider Modicon M340/BMX P34, Siemens S7-1200) in Government Services, Water/Wastewater and Energy sectors. Operators connected from leased VPS infrastructure using vendor engineering software (Rockwell Studio 5000 Logix Designer, Schneider EcoStruxure Control Expert, Siemens TIA Portal), modified project files, manipulated HMI/SCADA display data, and caused operational disruption and financial loss. Targeted ports: 44818, 2222, 102, 502, 22 (Dropbear SSH observed).
Supply chain and other drivers cited by Centrii: Chinese-manufactured solar inverters dominate European installations; researchers found remote-shutdown weaknesses and undocumented cellular hardware in inverters and batteries that can bypass utility firewalls; Centrii's GRIDLOCK model (September 2026) estimates a 92% probability of a major coordinated attack on UK battery storage by 2031 (61% with mandatory IEC 62443 certification). Russian-attributed physical sabotage in Europe (undersea cable plots, drone attacks) and Q1 2026 utility-sector ransomware across more than a dozen countries are also cited. Regulatory context: NIS2 enforcement, CER Directive, NERC CIP-015, TSA pipeline directives, and a U.S. executive order restricting foreign-linked grid equipment.
Severity is an analyst judgment. The source is secondary; IOCs here derive from AA26-097A and AA24-038A. BeaconBeagle returned HTTP 404 (no record) for the sampled IP 185.82.73.175.
MITRE ATT&CK techniques used in TL-2026-3319
Credential Access
Lateral Movement
T1021.001 Remote Desktop Protocol
Defense Evasion
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell
Persistence
Command and Control
T1090.003 Multi-hop Proxy; T1219 Remote Access Tools
Initial Access
T1190 Exploit Public-Facing Application
Impact
defense-impairment
Affected products and versions in Centrii: Nation-State Pre-Positioning (Volt Typhoon
- Rockwell Automation — Allen-Bradley CompactLogix / Micro850 PLCs
Vulnerable versions: Internet-exposed devices - Schneider Electric — Modicon M340 / BMX P34 PLCs
Vulnerable versions: Internet-exposed devices - Siemens — SIMATIC S7-1200 PLCs
Vulnerable versions: Internet-exposed devices - Cisco / NETGEAR — End-of-life SOHO routers (KV botnet)
Vulnerable versions: End-of-life models - Various — Grid-connected solar inverters and battery energy storage systems
Vulnerable versions: Supply-chain risk, no specific versions stated
Remediation for Centrii: Nation-State Pre-Positioning (Volt Typhoon
Patches
- Apply vendor patches for internet-facing appliances and PLC firmware per Rockwell, Schneider Electric and Siemens PSIRT guidance
Immediate actions
- Disconnect PLCs from the public internet; use secure gateways/VPN with MFA for remote access
- Block and hunt for AA26-097A IPs and traffic to ports 44818, 2222, 102, 502 and 22 from untrusted sources
- Place Rockwell PLC mode switches in RUN; enable programming protection in Siemens TIA Portal
- Change default PLC passwords; secure cellular modems with strong authentication
- Hunt for NTDS.dit copying (ESENT events 216/325/326/327), Security 1102 log clearing, and netsh portproxy changes
Workarounds
- Review PLC project files for unauthorized changes using vendor integrity-checking tools
- Restrict PLC communications with firewall rules/ACLs
Longer-term hardening
- Continuous, dated OT monitoring evidence (Centrii recommendation); align with IEC 62443 and NERC CIP-015
- Centralized logging and phishing-resistant MFA
- Decommission end-of-life edge devices (SOHO routers)
- Assess inverter/battery suppliers for undocumented cellular or remote-control interfaces
- Maintain tested offline backups of PLC logic and configurations
Timeline of Centrii: Nation-State Pre-Positioning (Volt Typhoon
- IRGC-affiliated CyberAv3ngers begin compromising internet-exposed Unitronics Vision Series PLCs with default credentials on TCP 20256 (earliest activity cited in AA23-335A)
- FBI, CISA, NSA, EPA and Israel's National Cyber Directorate publish AA23-335A on IRGC-affiliated actors exploiting PLCs in water and other sectors, a precursor to the 2026 AA26-097A activity
- CISA, NSA and FBI publish AA24-038A: Volt Typhoon pre-positioned in U.S. critical infrastructure IT networks for at least five years using living-off-the-land techniques
- FBI, CISA, NSA, EPA, DOE and USCYBERCOM publish AA26-097A on Iranian-affiliated actors exploiting internet-facing PLCs, with confirmed operational disruption and financial loss
- AA26-097A updated with a new table of actor IP addresses (July 2026 update)
- Centrii publishes analysis of nation-state access, renewable supply-chain risk and energy-sector financial exposure
- Industrial Cyber reports Centrii's findings, including the rise in Q1 2026 utility ransomware and the GRIDLOCK battery-storage model
Sources cited for Centrii: Nation-State Pre-Positioning (Volt Typhoon
- Centrii warns nation-state access and renewable supply-chain risks raise energy sector financial exposure
- Centrii: Cyber risk, financial event, grid security and geopolitics
- CISA AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
- CISA AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
- CISA AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities
- AA24-038A advisory PDF (NSA/DoD mirror)
- U.S. agencies alert: Iran-linked actors target critical infrastructure PLCs
- What to Know About CyberAv3ngers: The IRGC-Linked Group Targeting Critical Infrastructure
- ICS at multiple US water facilities targeted by hackers affiliated with Iranian government
- Australian Cyber Security Centre: PRC state-sponsored actors compromise US critical infrastructure (Volt Typhoon)
Detection coverage for TL-2026-3319
As of 2026-10-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3319 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.