CISA published advisory AA26-097A on 7 April 2026, attributing active exploitation of internet-exposed programmable logic controllers to Iranian IRGC-affiliated actors operating under the alias CyberAv3ngers. An updated version of the advisory was released on 22 July 2026, expanding vendor scope beyond the original Rockwell Automation and Unitronics findings to include Siemens TIA Portal and Schneider Electric systems, and adding new detection guidance for identifying malicious modifications to reusable code modules within PLC programs.
This analysis covers both the original advisory and the July update, with particular attention to the expanded vendor scope and the new forensic challenge of detecting tampered ladder logic and function blocks.
Threat Actor: CyberAv3ngers
CyberAv3ngers is attributed to the Iranian Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC). The group became prominent in late 2023 following attacks on Unitronics Vision Series PLCs at water utilities in the United States, including the Municipal Water Authority of Aliquippa in Pennsylvania, which received substantial media coverage after the group defaced the HMI display of an internet-exposed controller.
The group’s tactics combine opportunistic internet scanning with targeted exploitation of widely deployed industrial equipment. They are not a sophisticated persistent threat in the nation-state mould — they do not consistently demonstrate novel zero-day exploitation or long-term covert access. Their operational signature is more consistent with politically motivated disruption and harassment: defacing HMI displays, modifying setpoints to safe but operationally disruptive values, and demonstrating access to critical infrastructure to create anxiety about industrial security posture.
The April 2026 advisory reflected an escalation in scope: activity shifted from singular opportunistic incidents to an ongoing campaign with documented pre-positioning across government services, water and wastewater systems, and energy sector environments.
Original Advisory Findings (April 2026)
The April advisory documented exploitation across three primary attack surfaces:
Internet-exposed Rockwell Automation/Allen-Bradley PLCs: Rockwell Automation Logix series controllers exposed on port 44818 (Ethernet/IP) and port 2222 (proprietary SRTP protocol). CyberAv3ngers used default or weak credentials to access controllers directly, modified control logic, and in some cases adjusted process setpoints.
Internet-exposed Unitronics Vision PLCs: Unitronics Vision Series controllers, already the subject of the 2023 incidents, continued to appear in CyberAv3ngers targeting where they remained unaddressed. The advisory noted that many of the originally affected controllers had not been patched or isolated despite 2023 public guidance.
Modem access on port 22: Beyond direct PLC exposure, the actors targeted modem interfaces providing serial-to-IP connectivity for older field devices, using brute-forced credentials to reach equipment not otherwise internet-connected.
The advisory recommended immediate network isolation of PLCs from internet exposure, credential rotation, and audit of recently changed ladder logic or controller parameters.
July 2026 Update: Expanded Vendor Scope
The July revision reflects intelligence about CyberAv3ngers activity against two additional vendor ecosystems.
Siemens TIA Portal: Siemens PLCs using the S7comm protocol (port 102) and systems accessible through TIA Portal have been identified in targeting reconnaissance. The advisory does not disclose specific intrusion confirmations at Siemens-equipped sites with the specificity available for Rockwell and Unitronics cases, but documents active scanning and initial access attempts against Siemens field devices across the target sectors.
S7comm does not implement native authentication in older protocol versions (S7comm-plus adds authentication, but many deployed S7-300 and S7-400 series controllers use legacy S7comm). Any internet-exposed Siemens controller reachable on port 102 that has not been isolated should be treated as a priority remediation item based on the July guidance.
Schneider Electric: Schneider Electric Modicon controllers accessible via Modbus TCP (port 502) are included in the July scope expansion. Modbus TCP has no authentication at all — any system on the network that can reach the controller on port 502 can read and write coil and register values without credentials. The attack surface against internet-exposed Modicon controllers is therefore immediate and requires no credential exploitation.
New Detection Challenge: Reusable Code Module Tampering
The July update includes guidance that represents a genuinely new forensic challenge for OT defenders: detecting malicious modifications within reusable PLC code modules and function blocks.
Most industrial control system forensics focuses on initial access indicators — network connections, authentication logs, firewall rules. Once an attacker has been and gone (or is quietly resident), the more difficult question is whether the control logic itself has been modified. PLC programs are compiled to proprietary bytecode and uploaded to the controller; many industrial environments lack baseline comparisons of what the program should look like at the code level.
Reusable code modules (AOIs in Rockwell Studio 5000, function blocks in Siemens TIA Portal, derived function blocks in Schneider EcoStruxure) are particularly vulnerable to subtle modification because:
- They are used across multiple instances within a program
- They are often imported from libraries and not reviewed after initial validation
- A modification to a reusable module affects every instance of its use — potentially altering behaviour across an entire system from a single change
The advisory guidance recommends:
-
Establishing program baselines: Export and archive the full PLC program at a known-good state. For Rockwell, this is the L5X export; for Siemens, the TIA Portal project archive. This establishes a comparison point for forensic differential analysis.
-
Periodic program comparison: Re-export current program state and compare against baseline. Any differences in ladder logic, function block code, or tag definitions warrant investigation. Automated tools for Rockwell and Siemens program comparison exist (Totem by Dragos, vendor-specific audit tools) but many OT environments perform this manually.
-
Monitoring for PLC programming connections: Legitimate programming operations in industrial environments are relatively infrequent and typically scheduled. Log and alert on incoming connections to PLC programming ports (Logix 44818, S7comm 102, Modicon 502) outside of known maintenance windows.
For Rockwell Studio 5000 specifically, the AOI comparison process:
1. Export project as L5X (XML format)
2. Compare against baseline L5X using XML diff tools (e.g., diff, WinMerge)
3. Focus comparison on: Routine definitions, AOI source code sections, tag values with no documented reason to change
4. Investigate any unexplained differences in logic or initial tag valuesAffected Protocol and Port Summary
| Vendor | Protocol | Port | Authentication |
|---|---|---|---|
| Rockwell Allen-Bradley | Ethernet/IP | 44818 | Varies by firmware; older firmware weak or none |
| Rockwell Allen-Bradley | SRTP (legacy) | 2222 | Minimal |
| Siemens S7-300/400 | S7comm | 102 | None (legacy); S7comm-plus adds auth |
| Siemens S7-1200/1500 | S7comm-plus | 102 | Certificate-based (if configured) |
| Schneider Modicon | Modbus TCP | 502 | None |
| Various | SSH modem access | 22 | Credential-based |
Recommended Actions
Immediate: Verify internet exposure using Shodan or censys.io. Any device from the above vendors reachable on the listed ports from the public internet should be isolated as an emergency action. CISA and FBI guidance is unambiguous: PLCs and industrial devices should not be internet-facing.
Short-term: Rotate all default and weak credentials on PLC and HMI systems. Enable authentication on Siemens TIA Portal connections where S7comm-plus is supported. Implement network-layer access control lists restricting PLC programming ports to known engineering workstations.
Medium-term: Establish program baseline exports for all critical PLCs. Implement monitoring for connections to programming ports. Configure historian or SCADA alerting for setpoint changes outside of defined operational bands without associated operator action.
For Siemens environments specifically: S7-1200 and S7-1500 series controllers support access level protection and know-how protection (ladder logic obfuscation). Enable both on all internet-accessible or high-consequence controllers.
For Schneider Modicon environments: Modbus TCP’s lack of authentication cannot be patched through firmware — it is a protocol design characteristic. The only mitigation is network segmentation ensuring no untrusted system can reach port 502. This makes Modicon environments that lack proper segmentation an urgent remediation priority based on the July advisory scope expansion.
The pattern of CyberAv3ngers activity — active scanning, credential exploitation, setpoint modification — does not require sophisticated attacker capability. It exploits decades of accumulated internet exposure in industrial networks that were built when connectivity assumptions were different. The July update’s expansion to Siemens and Schneider environments should be read as a signal to audit every internet-accessible industrial device, not just the vendor platforms specifically named.