Iranian-Affiliated Actors Exploit Internet-Exposed PLCs (Rockwell, Schneider, Siemens) in U.S. Critical Infrastructure (CISA AA26-097A)

Key facts

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5544 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: AA26-097A Internet-Sourced Sessions to PLC Ports (44818/2222/102/502)

Flags allowed sessions from public IP space to the PLC ports named in CISA AA26-097A (44818, 2222, 102, 502) and tags sources that match the advisory's listed infrastructure (e.g. 185.82.73.175, 88.80.150.199). Internet exposure of PLCs is the only precondition the Iranian-affiliated actors need, since no CVE is involved.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1133, T1078, T1571
• Data sources: pan:traffic firewall logs (index=network), CommonSecurityLog (CEF firewall)
• Severity: high
• Confidence: high

Splunk SPL

index=network sourcetype="pan:traffic" action=allowed dest_port IN (44818, 2222, 102, 502) earliest=-24h
```TL-2026-5544 / AA26-097A: allowed Internet-sourced sessions to PLC ports (EtherNet/IP 44818, 2222, S7 102, Modbus 502)```
| where NOT (cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip) OR cidrmatch("127.0.0.0/8",src_ip) OR cidrmatch("169.254.0.0/16",src_ip))
| eval ioc_hit=if(match(src_ip,"^(185[.]82[.]73[.](162|164|165|167|168|170|171|175)|141[.]11[.]164[.]153|175[.]110[.]121[.](39|41|42|107)|192[.]142[.]54[.]79|84[.]200[.]205[.]165|185[.]225[.]17[.]225|79[.]133[.]46[.]209|88[.]80[.]150[.](199|200|202)|135[.]136[.]1[.]133)$"),"AA26-097A-listed","not-listed")
| stats count dc(dest_ip) as plc_targets values(dest_ip) as targets values(dest_port) as ot_ports min(_time) as first_seen max(_time) as last_seen by src_ip ioc_hit
| convert ctime(first_seen) ctime(last_seen)
| sort - plc_targets

Microsoft KQL

let OtPorts = dynamic([44818, 2222, 102, 502]);
let ListedIps = dynamic(['185.82.73.162', '185.82.73.164', '185.82.73.165', '185.82.73.167', '185.82.73.168', '185.82.73.170', '185.82.73.171', '185.82.73.175', '141.11.164.153', '175.110.121.39', '175.110.121.41', '175.110.121.42', '175.110.121.107', '192.142.54.79', '84.200.205.165', '185.225.17.225', '79.133.46.209', '88.80.150.199', '88.80.150.200', '88.80.150.202', '135.136.1.133']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceAction in~ ('allow', 'allowed', 'accept', 'permit')
| where DestinationPort in (OtPorts)
| where not(ipv4_is_private(SourceIP))
| extend ListedInfra = SourceIP in (ListedIps)
| summarize Connections = count(), PlcTargets = dcount(DestinationIP), Targets = make_set(DestinationIP, 50), OtPortsSeen = make_set(DestinationPort), First = min(TimeGenerated), Last = max(TimeGenerated) by SourceIP, ListedInfra
| order by PlcTargets desc

Sigma

title: Internet-Sourced Connection to PLC OT Ports (AA26-097A)
id: 3b0e6a52-7c1d-4e0f-9a41-5d2f8c6b1a01
status: experimental
description: Detects allowed inbound sessions from non-private addresses to EtherNet/IP (44818, 2222), Siemens S7comm (102) and Modbus/TCP (502) ports, the access pattern used by Iranian-affiliated actors against internet-exposed PLCs in CISA AA26-097A.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
  - https://www.trendmicro.com/en_us/research/26/g/plc-exploitation.html
author: Threadlinqs Team
date: 2026/11/09
tags:
  - attack.initial-access
  - attack.t1133
  - attack.t1078
  - attack.command-and-control
  - attack.t1571
logsource:
  category: firewall
detection:
  selection:
    dst_port:
      - 44818
      - 2222
      - 102
      - 502
    action:
      - allow
      - allowed
      - accept
  filter_internal_src:
    src_ip|cidr:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 127.0.0.0/8
      - 169.254.0.0/16
  condition: selection and not filter_internal_src
falsepositives:
  - Authorised vendor or integrator remote support arriving through a known public egress address
  - Cloud-hosted SCADA or historian services polling controllers by design
level: high

Known false positives:

• Authorised integrator or vendor remote-support sessions from a fixed public address
• Cloud historian or SCADA gateway that polls PLCs by design
• Authorised internal vulnerability scanners using public NAT egress

Tuning notes: Replace the index/sourcetype with your firewall's; add a destination filter for your PLC subnets; allowlist approved vendor egress IPs via a lookup. Any hit with ioc_hit=AA26-097A-listed should be escalated immediately (FBI advises vetting IPs, as some listed hosts are not confirmed C&C). Ideally no match should exist at all: remove the exposure.

• 🔒 AA26-097A PLC Engineering Software Reaching Public IPs on OT Ports · unlock with TL Creds
• 🔒 AA26-097A PLC Project File Written by Non-Engineering Process · unlock with TL Creds
• 🔒 AA26-097A Endpoint Outbound Connection to Listed C&C Infrastructure · unlock with TL Creds
• 🔒 AA26-097A Blocked Internet Probing of PLC Ports (Reconnaissance) · unlock with TL Creds
• 🔒 AA26-097A Associated Malware Hashes (IOCONTROL / MALPDB) · unlock with TL Creds
• 🔒 AA26-097A Listed C&C Domain DNS Resolution · unlock with TL Creds
• 🔒 AA26-097A Dropbear SSH Execution on Modem or Linux Gateway · unlock with TL Creds
• 🔒 AA26-097A Sessions With Listed Actor Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5544.

Sample indicators (3 of 30)

• IP address: 185.82.73[.]175
• Domain: ocferda[.]com
• File hash: 366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

Technical analysis

No software vulnerability is required.

Joint advisory AA26-097A (first issued 2026-04-07, revised 2026-07-22) describes ongoing targeting of misconfigured, internet-accessible operational technology devices, mainly PLCs. Initial activity centered on Rockwell Automation/Allen-Bradley CompactLogix and Micro850 controllers; the July 2026 revision expanded scope to Schneider Electric (BMX P34 / Modicon M340), Siemens (S7-1200 series) and other branded PLCs. Affected sectors are Government Services and Facilities (including local municipalities), Water and Wastewater Systems, and Energy.

The actors reach PLCs from foreign IP addresses and leased third-party hosting using manufacturer programming software (Studio 5000 Logix Designer, EcoStruxure Control Expert, TIA Portal), mimicking an authorized technician. Per the advisory, traffic uses common OT ports (44818, 2222, 102, 502 for PLCs; 22 for modems). In one instance Dropbear SSH was deployed on victim cellular modems for remote access. From July 2026 the advisory also documents project files being pulled from PLCs via the same configuration software on hosted infrastructure (Exfiltration).

Impact: project-file logic, including Rockwell Add-On Instructions (AOIs), was modified or deleted; HMI and SCADA data was altered; and critical shutdown and alarm logic was disabled so systems could enter unsafe states without alerting operators. At one victim a malicious project file retained legitimate ladder logic but overrode instruction sets that maintain safe operating parameters. The July revision adds detection guidance for malicious changes in reusable code modules (Rockwell). Unlike the 2023 campaign, this activity has caused confirmed operational disruption and financial loss for some organizations.

Attribution: the advisory assesses the actors as Iranian-affiliated and links the activity to earlier CyberAv3ngers activity (IRGC-CEC affiliated; also Hydro Kitten, Shahid Kaveh Group, Storm-0784), which compromised at least 75 Unitronics PLCs in the November 2023 campaign (AA23-335A). Trend Micro's article makes the same association and lists two malware detections (Backdoor.Linux.IOCONTROL.CIGBCBF, Trojan.Win64.MALPDB.A) and C2 infrastructure; Trend labels most listed IPs/domains as C&C servers. The agencies did not formally name a specific group for the 2026 activity. The FBI advises vetting IPs before blocking. Trend cites about 74,000 internet-reachable ICS devices via Shodan, many with default or no credentials. No CVE or CVSS applies; the weakness is architectural (internet exposure, weak authentication, poor segmentation).

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Command and Control

T1219 Remote Access Tools

Impact

T1565 Data Manipulation

Resource Development

T1583.003 Virtual Private Server

Reconnaissance

T1595 Active Scanning

Remediation

Patches

• No CVE patch applies; follow Rockwell SD1771, Siemens SSB-104599 and Schneider Electric hardening guidance

Immediate actions

• Remove PLCs from direct internet exposure; route remote access through a secure gateway or jump host with MFA and remove inbound port exposure
• Search firewall, IDS and network logs for the listed IPs on ports 22, 102, 502, 2222 and 44818; vet IPs before blocking
• Restrict PLC network access with firewall rules/ACLs and block hosting-provider and unauthorized IPs
• Set hardware mode switches to RUN outside supervised maintenance and validate project files first
• Secure and log cellular modems; consider private APN, ZTNA or site-to-site VPN

Workarounds

• Change default passwords to unique complex ones
• Disable unused services (Telnet, FTP, RDP, VNC, web interfaces)
• Enforce MFA on all external OT access

Longer-term hardening

• Enable programming protection (software key switching) on supporting PLCs
• Maintain offline, verified backups of PLC logic and configuration and test restores
• Monitor asset management and network traffic for configuration, mode and program changes against a known-good baseline
• Review running project files and Rockwell AOIs against known-good logic; reimage affected modems, HMIs and workstations
• Continuously validate internet reachability into OT and segmentation

Affected and fixed versions

• Rockwell Automation — Allen-Bradley CompactLogix, Micro850 PLCs; Studio 5000 Logix Designer
  Vulnerable versions: Internet-exposed / misconfigured devices
• Schneider Electric — BMX P34 / Modicon M340 PLCs; EcoStruxure Control Expert
  Vulnerable versions: Internet-exposed / misconfigured devices
• Siemens — S7-1200 series PLCs; TIA Portal
  Vulnerable versions: Internet-exposed / misconfigured devices

Timeline

• 2023-11-22 CyberAv3ngers (IRGC-affiliated) begins accessing internet-exposed Unitronics PLCs in U.S. water facilities with default credentials; at least 75 devices compromised in the 2023-2024 campaign (AA23-335A).
• 2025-01-01 Earliest listed AA26-097A infrastructure (locked-ioc-18/.164/.165/.167/.168/.170/.171) becomes active (January 2025).
• 2025-09-01 locked-ioc-12 active from September 2025 through February 2026.
• 2026-02-01 175.110.121.0/24 hosts (.39, .41, .42, .107) active February-March 2026.
• 2026-04-07 FBI, CISA, NSA, EPA, DOE, CNMF and Treasury issue AA26-097A on Iranian-affiliated exploitation of Rockwell CompactLogix and Micro850 PLCs.
• 2026-05-01 locked-ioc-13 and locked-ioc-10 observed May-June 2026; locked-ioc-11 from June 2026.
• 2026-07-01 locked-ioc-14 and locked-ioc-15/.200/.202 observed in July 2026.
• 2026-07-22 AA26-097A revised: scope expanded to Schneider Electric, Siemens and other PLCs; Exfiltration tactic, malicious reusable-code detection guidance and updated IOCs added.
• 2026-07-23 Trend Micro publishes analysis with C2 IPs, domains and malware hashes and links activity to the 2023 CyberAv3ngers campaign.

Sources cited

• CISA AA26-097A: Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure CISA · Government advisory · 2026-04-07
• CISA AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors CISA · Government advisory · 2023-12-01
• CISA Secure by Demand: Priority Considerations for OT Owners and Operators CISA · Advisory · 2026-07-22
• CISA AA23-278A: Top Ten Cybersecurity Misconfigurations CISA · Advisory · 2023-10-05
• Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure (Trend Micro) Trend Micro · Research · 2026-07-23
• Rockwell Automation Security Advisory SD1771 rockwellautomation.com · Vendor report · 2026-04-07
• Siemens Cybersecurity for Industry Operational Guidelines cert-portal.siemens.com · Vendor report · 2026-07-22

Related threats

• OT Attacks on US Critical Infrastructure: Volt Typhoon Persistence and Iranian-Affiliated PLC Exploitation (Rockwell, Unitronics, Siemens S7)
• Centrii: Nation-State Pre-Positioning (Volt Typhoon, IRGC-Affiliated PLC Exploitation) and Renewable Supply-Chain Risk Raise Energy Sector Exposure
• Threat actors targeting internet-exposed PLCs in US water/wastewater sector causing lockouts, disconnections and boil water notices (CISA alert 2026-07-30; Iranian-affiliated PLC campaign AA26-097A)
• AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure
• Sage Water Resources Utah saltwater disposal facility PLC intrusion — Iranian IRGC-CEC (CyberAv3ngers) logic manipulation bypasses pump safeguards

Related coverage of this activity

• CyberAv3ngers Rockwell PLC intrusions

Previous and next in ics scada

• Malicious Cyber Activity Targeting Industrial Refrigeration and Cold Chain Monitoring Systems (Danfoss StoreView, Copeland/Dixell XWEB, Coolworld) Previous report
• Copeland XWEB PRO refrigeration controllers abused for spam botnet, proxy/tunnel traffic and default-credential setpoint tampering (CVE-2026-25085 suspected entry point) Next report