Iranian-linked hackers compromise programmable logic controllers across US critical infrastructure sectors

Six US government agencies jointly warned of a coordinated campaign targeting programmable logic controllers at critical US infrastructure on April 8, 2026. The FBI, Cybersecurity and Infrastructure Security Agency, National Security Agency, Environmental Protection Agency, Department of Energy, and US Cyber Command identified an Iranian-affiliated advanced persistent threat group conducting disruptions since at least March 2026 across water systems, energy facilities, and government operations.

The attackers are using legitimate Rockwell automation software—specifically Studio 5000 Logix Designer—to directly access and manipulate industrial devices deployed in factories, refineries, water treatment centers, and remote facilities. This approach bypasses the need for zero-day exploits, making the campaign relatively straightforward to execute but difficult to detect through conventional security monitoring. Targeted device families include CompactLogix and Micro850 controllers.

A Censys internet scan found 5,219 Rockwell-manufactured PLCs exposed directly to the internet, with roughly 75 percent located within the United States. The attackers are connecting through a single Windows engineering workstation running the Rockwell tool chain, communicating over a non-standard TCP port using a self-signed certificate. The workstation also exposes standard Windows networking protocols including DCERPC, MSMQ, and NetBIOS, suggesting a staging infrastructure rather than a sophisticated or ephemeral operation.

The campaign represents an escalation in Iranian cyber activity against US industrial targets. A similar group known as CyberAv3ngers conducted PLC attacks in 2023, and the Handala group, associated with Iranian interests, claimed responsibility for a March 2026 intrusion at medical device maker Stryker that disrupted operations for several days. Pro-Iran proxy groups have also been observed conducting distributed denial-of-service attacks against consumer platforms and Australian government systems.

Victims have reported operational disruption and financial losses, though the advisory did not provide quantified impact assessments or identify specific compromised organizations. The advisory included technical indicators including IP addresses and guidance for securing exposed devices.