# Iranian-Affiliated Actors Exploit Internet-Exposed PLCs (Rockwell, Schneider, Siemens) in U.S. Critical Infrastructure (CISA AA26-097A)

> FBI, CISA, NSA, EPA, DOE, U.S. Cyber Command and Treasury warn that Iranian-affiliated actors are attacking internet-facing PLCs in U.S. government services, water/wastewater and energy. Actors use legitimate engineering software to alter controller logic and manipulate HMI/SCADA displays, causing operational disruption and financial loss at some victims. No software vulnerability is required.

- **Published:** 2026-11-09T11:20:32Z
- **Last reviewed:** 2026-11-09T11:20:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5544
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5544.png
- **ID:** TL-2026-5544
- **Severity:** CRITICAL
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Actor:** Iranian-affiliated actors (Iran)
- **Detections:** 9 (1 shown free below) · **IOCs:** 30 (3 shown free below)

## Description

Joint advisory AA26-097A (first issued 2026-04-07, revised 2026-07-22) describes ongoing targeting of misconfigured, internet-accessible operational technology devices, mainly PLCs. Initial activity centered on Rockwell Automation/Allen-Bradley CompactLogix and Micro850 controllers; the July 2026 revision expanded scope to Schneider Electric (BMX P34 / Modicon M340), Siemens (S7-1200 series) and other branded PLCs. Affected sectors are Government Services and Facilities (including local municipalities), Water and Wastewater Systems, and Energy.

The actors reach PLCs from foreign IP addresses and leased third-party hosting using manufacturer programming software (Studio 5000 Logix Designer, EcoStruxure Control Expert, TIA Portal), mimicking an authorized technician. Per the advisory, traffic uses common OT ports (44818, 2222, 102, 502 for PLCs; 22 for modems). In one instance Dropbear SSH was deployed on victim cellular modems for remote access. From July 2026 the advisory also documents project files being pulled from PLCs via the same configuration software on hosted infrastructure (Exfiltration).

Impact: project-file logic, including Rockwell Add-On Instructions (AOIs), was modified or deleted; HMI and SCADA data was altered; and critical shutdown and alarm logic was disabled so systems could enter unsafe states without alerting operators. At one victim a malicious project file retained legitimate ladder logic but overrode instruction sets that maintain safe operating parameters. The July revision adds detection guidance for malicious changes in reusable code modules (Rockwell). Unlike the 2023 campaign, this activity has caused confirmed operational disruption and financial loss for some organizations.

Attribution: the advisory assesses the actors as Iranian-affiliated and links the activity to earlier CyberAv3ngers activity (IRGC-CEC affiliated; also Hydro Kitten, Shahid Kaveh Group, Storm-0784), which compromised at least 75 Unitronics PLCs in the November 2023 campaign (AA23-335A). Trend Micro's article makes the same association and lists two malware detections (Backdoor.Linux.IOCONTROL.CIGBCBF, Trojan.Win64.MALPDB.A) and C2 infrastructure; Trend labels most listed IPs/domains as C&C servers. The agencies did not formally name a specific group for the 2026 activity. The FBI advises vetting IPs before blocking. Trend cites about 74,000 internet-reachable ICS devices via Shodan, many with default or no credentials. No CVE or CVSS applies; the weakness is architectural (internet exposure, weak authentication, poor segmentation).

## MITRE ATT&CK

- T1595 Active Scanning
- T1583.003 Virtual Private Server
- T1078 Valid Accounts
- T1219 Remote Access Tools
- T1565 Data Manipulation

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**AA26-097A Internet-Sourced Sessions to PLC Ports (44818/2222/102/502)** (`TL-2026-5544-SPL-001`)

Flags allowed sessions from public IP space to the PLC ports named in CISA AA26-097A (44818, 2222, 102, 502) and tags sources that match the advisory's listed infrastructure (e.g. 185.82.73.175, 88.80.150.199). Internet exposure of PLCs is the only precondition the Iranian-affiliated actors need, since no CVE is involved.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1133, T1078, T1571
- **Data sources:** pan:traffic firewall logs (index=network), CommonSecurityLog (CEF firewall)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=network sourcetype="pan:traffic" action=allowed dest_port IN (44818, 2222, 102, 502) earliest=-24h
```TL-2026-5544 / AA26-097A: allowed Internet-sourced sessions to PLC ports (EtherNet/IP 44818, 2222, S7 102, Modbus 502)```
| where NOT (cidrmatch("10.0.0.0/8",src_ip) OR cidrmatch("172.16.0.0/12",src_ip) OR cidrmatch("192.168.0.0/16",src_ip) OR cidrmatch("127.0.0.0/8",src_ip) OR cidrmatch("169.254.0.0/16",src_ip))
| eval ioc_hit=if(match(src_ip,"^(185[.]82[.]73[.](162|164|165|167|168|170|171|175)|141[.]11[.]164[.]153|175[.]110[.]121[.](39|41|42|107)|192[.]142[.]54[.]79|84[.]200[.]205[.]165|185[.]225[.]17[.]225|79[.]133[.]46[.]209|88[.]80[.]150[.](199|200|202)|135[.]136[.]1[.]133)$"),"AA26-097A-listed","not-listed")
| stats count dc(dest_ip) as plc_targets values(dest_ip) as targets values(dest_port) as ot_ports min(_time) as first_seen max(_time) as last_seen by src_ip ioc_hit
| convert ctime(first_seen) ctime(last_seen)
| sort - plc_targets
````

### Microsoft KQL

```kql
let OtPorts = dynamic([44818, 2222, 102, 502]);
let ListedIps = dynamic(['185.82.73.162', '185.82.73.164', '185.82.73.165', '185.82.73.167', '185.82.73.168', '185.82.73.170', '185.82.73.171', '185.82.73.175', '141.11.164.153', '175.110.121.39', '175.110.121.41', '175.110.121.42', '175.110.121.107', '192.142.54.79', '84.200.205.165', '185.225.17.225', '79.133.46.209', '88.80.150.199', '88.80.150.200', '88.80.150.202', '135.136.1.133']);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DeviceAction in~ ('allow', 'allowed', 'accept', 'permit')
| where DestinationPort in (OtPorts)
| where not(ipv4_is_private(SourceIP))
| extend ListedInfra = SourceIP in (ListedIps)
| summarize Connections = count(), PlcTargets = dcount(DestinationIP), Targets = make_set(DestinationIP, 50), OtPortsSeen = make_set(DestinationPort), First = min(TimeGenerated), Last = max(TimeGenerated) by SourceIP, ListedInfra
| order by PlcTargets desc
```

### Sigma

```yaml
title: Internet-Sourced Connection to PLC OT Ports (AA26-097A)
id: 3b0e6a52-7c1d-4e0f-9a41-5d2f8c6b1a01
status: experimental
description: Detects allowed inbound sessions from non-private addresses to EtherNet/IP (44818, 2222), Siemens S7comm (102) and Modbus/TCP (502) ports, the access pattern used by Iranian-affiliated actors against internet-exposed PLCs in CISA AA26-097A.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
  - https://www.trendmicro.com/en_us/research/26/g/plc-exploitation.html
author: Threadlinqs Team
date: 2026/11/09
tags:
  - attack.initial-access
  - attack.t1133
  - attack.t1078
  - attack.command-and-control
  - attack.t1571
logsource:
  category: firewall
detection:
  selection:
    dst_port:
      - 44818
      - 2222
      - 102
      - 502
    action:
      - allow
      - allowed
      - accept
  filter_internal_src:
    src_ip|cidr:
      - 10.0.0.0/8
      - 172.16.0.0/12
      - 192.168.0.0/16
      - 127.0.0.0/8
      - 169.254.0.0/16
  condition: selection and not filter_internal_src
falsepositives:
  - Authorised vendor or integrator remote support arriving through a known public egress address
  - Cloud-hosted SCADA or historian services polling controllers by design
level: high

```

**Known false positives:**

- Authorised integrator or vendor remote-support sessions from a fixed public address
- Cloud historian or SCADA gateway that polls PLCs by design
- Authorised internal vulnerability scanners using public NAT egress

**Tuning notes:** Replace the index/sourcetype with your firewall's; add a destination filter for your PLC subnets; allowlist approved vendor egress IPs via a lookup. Any hit with ioc_hit=AA26-097A-listed should be escalated immediately (FBI advises vetting IPs, as some listed hosts are not confirmed C&C). Ideally no match should exist at all: remove the exposure.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- AA26-097A PLC Engineering Software Reaching Public IPs on OT Ports (locked: unlock with TL Creds)
- AA26-097A PLC Project File Written by Non-Engineering Process (locked: unlock with TL Creds)
- AA26-097A Endpoint Outbound Connection to Listed C&C Infrastructure (locked: unlock with TL Creds)
- AA26-097A Blocked Internet Probing of PLC Ports (Reconnaissance) (locked: unlock with TL Creds)
- AA26-097A Associated Malware Hashes (IOCONTROL / MALPDB) (locked: unlock with TL Creds)
- AA26-097A Listed C&C Domain DNS Resolution (locked: unlock with TL Creds)
- AA26-097A Dropbear SSH Execution on Modem or Linux Gateway (locked: unlock with TL Creds)
- AA26-097A Sessions With Listed Actor Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 30)

Defanged, TLP:CLEAR.

- IP address: `185.82.73[.]175`
- Domain: `ocferda[.]com`
- File hash: `366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb`

Full set of 30 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CISA AA26-097A: Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure (Trend Micro)](https://www.trendmicro.com/en_us/research/26/g/plc-exploitation.html)
- [CISA AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a)
- [Rockwell Automation Security Advisory SD1771](https://www.rockwellautomation.com/en-us/trust-center/security-advisories/advisory.SD1771.html)
- [Siemens Cybersecurity for Industry Operational Guidelines](https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf)
- [CISA Secure by Demand: Priority Considerations for OT Owners and Operators](https://www.cisa.gov/resources-tools/resources/secure-demand-priority-considerations-operational-technology-owners-and-operators-when-selecting)
- [CISA AA23-278A: Top Ten Cybersecurity Misconfigurations](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5544