Iran-linked crews are probing more flavors of US industrial kit
The US Cybersecurity and Infrastructure Security Agency (CISA) has expanded the scope of its alert on Iranian-affiliated hackers attacking critical infrastructure, including water and energy facilities.
The original advisory focused on programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley. The update warns that the activity may also target devices from Schneider Electric, Siemens, "and potentially other branded/manufactured PLCs."
The conflict between the US and Iran is well into its fourth month, and authorities have noticed Iranian-affiliated advanced persistent threat (APT) crews targeting PLCs to cause disruption since March.
REG AD
PLCs are used to control and monitor industrial processes. Authorities said the activity resembled earlier attacks on PLCs by CyberAv3ngers (aka the Shahid Kaveh Group) - hackers affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).
REG AD
MORE CONTEXT
- Water company's leaky security earns near-£1M fine
- Iran cyber actors disrupting US water, energy facilities, FBI warns
- Iran's cyberwar has begun
- Cyberpunks mess with Canada's water, energy, and farm systems
-
columnists Airbus takes flight from AWS. What happens next is critical
-
off-prem Anyone with a shed, an extension cord, a couple of GPUs and an overdraft is building datacenters. Fujitsu just offloaded five
-
security Linux kernel team publishes 432 CVEs in two days
-
AI AND ML OpenAI admits it was the source of the agent swarm that attacked Hugging Face
-
off-prem AWS customer learns the hard way how even the smallest oversight can be mission-critical - DEVOPS Model Context Protocol prepares to break with its stateful past Biggest overhaul since launch ditches sessions, guts little-used features, and leaves homebrew implementations facing a slog
- Offbeat Tesla burns through a billion as Musk bets the farm on chips and bots Optimus remains 'very complex' and Robotaxis will try not to flatten your cat
- software IBM insists AI didn't kill software deals, just delayed them Big Blue says customers postponed rather than abandoned major purchases as hardware soaked up enterprise budgets
- offbeat UK pumps £708 million into its future fighter jet Tempest cash lands alongside hypersonic target contract and BAE's 'loyal wingman' drone reveal
- AI and ML OpenAI scored an own goal with HuggingFace attack, showing how open Chinese models are winning Closed models with guardrails can still cause harm, but may also not be able to fix problems they caused
- Security Russians are posing as Signal support to launch phishing attacks PLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!
- Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack PLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more
- Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructure Voting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included
- Security EQT buys majority share in Swiss cybersecurity biz Acronis Went at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified
- Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight On the plus side, infosec's a good bet for a long, stable career
- GNOME can look like Windows – and Flashback can do it without extensions New 'Simple-taskbar' is an option, but there's a simpler, stabler way
- A moment of silence, please, for the final release of Debian on x86-32 New Debian versions hit FOSSland in the form of 13.6 and 12.15
- Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites Flaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide
- Frame: A new X11 server – implemented directly in assembly Joins yserver, Phoenix, and of course XLibre – and outlier Arcan
- Cinnamon 6.8 will support Wayland – if you want it Next version of Linux Mint’s desktop has both kinds of display server
- KDE Plasma users face a dire omen of change: 6.6.6 arrives 6.7 is now current, and in 6.8 you're getting Wayland whether you like it or not
The focus is principally related to internet-facing PLCs. CISA noted attackers targeting devices through open ports: "The targeting of ports associated with other OT vendors' protocols suggests these actors are opportunistically targeting devices manufactured by companies other than Rockwell Automation/Allen-Bradley, including Schneider Electric and Siemens.
"In one reported instance, the actors utilized Dropbear Secure Shell (SSH) software on victim modems to enable them to gain remote access through port 22."
Once in, attackers extract device project files and modify or delete their logic.
"Additionally, the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies," CISA said.
The expansion of the advisory's scope to include additional PLCs highlights the importance of being aware of what is accessible. On top of to earlier mitigations that included disconnecting the PLC from the public-facing internet, authorities have suggested organizations consider implementing isolated architectures and controlling network access to PLC devices.
It would also be a good idea to check project files running on PLCs for unauthorized changes, make sure service providers are aware of threats targeting PLCs, and ensure default passwords are changed. ®
[](https://www.facebook.com/sharer.php?u=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F07%2F23%2Firan-linked-crews-are-probing-more-flavors-of-us-industrial-kit%2F5277003) [](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F07%2F23%2Firan-linked-crews-are-probing-more-flavors-of-us-industrial-kit%2F5277003) [](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F07%2F23%2Firan-linked-crews-are-probing-more-flavors-of-us-industrial-kit%2F5277003) [](https://bsky.app/intent/compose?text=Iran-linked%20crews%20are%20probing%20more%20flavors%20of%20US%20industrial%20kit%0Ahttps%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F07%2F23%2Firan-linked-crews-are-probing-more-flavors-of-us-industrial-kit%2F5277003) [](https://www.reddit.com/submit?url=https%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F07%2F23%2Firan-linked-crews-are-probing-more-flavors-of-us-industrial-kit%2F5277003&title=Iran-linked%20crews%20are%20probing%20more%20flavors%20of%20US%20industrial%20kit) [](https://api.whatsapp.com/send?text=Iran-linked%20crews%20are%20probing%20more%20flavors%20of%20US%20industrial%20kit%0Ahttps%3A%2F%2Fwww.theregister.com%2Fsecurity%2F2026%2F07%2F23%2Firan-linked-crews-are-probing-more-flavors-of-us-industrial-kit%2F5277003)
REG AD
Patches Year-long Russian attacks infect users as soon as they look at an email Phishing for dummies