CISA advisory AA26-097A, originally published on 7 April 2026 by the FBI, CISA, NSA, EPA, Department of Energy, and U.S. Cyber Command’s Cyber National Mission Force, was substantially updated on 22 July 2026. The update expands the confirmed scope of Iranian-affiliated PLC exploitation beyond the initial Rockwell Automation Allen-Bradley targeting to include Schneider Electric Modicon M340 (BMX P34 series) and Siemens S7-1200 series programmable logic controllers. The U.S. Treasury Department joined as an additional co-signatory in the July update.
The campaign is a continuation of the same Iranian-affiliated threat actor group responsible for the November 2023 CyberAv3ngers attacks on Unitronics PLCs across U.S. water and wastewater facilities.
Evolution of the Campaign
The 2023 CyberAv3ngers campaign targeted Unitronics Vision Series PLCs using default credentials accessible via internet-facing HMI interfaces. At least 75 devices across U.S. water and wastewater facilities were compromised. The campaign caused operational disruption at several small water utilities and generated significant attention due to the direct overlap with Israel-linked targeting narratives (Unitronics is an Israeli company).
The 2026 campaign documented in AA26-097A represents a material escalation in scope and sophistication:
- Expanded vendor targeting: From a single vendor (Unitronics) to three major industrial automation vendors (Rockwell, Schneider Electric, Siemens)
- Protocol exploitation: Where the 2023 campaign relied on default credentials, the 2026 campaign includes exploitation of legitimate PLC remote programming protocols
- Data exfiltration: Confirmed extraction of
.ACDproject files from Allen-Bradley controllers (Rockwell’s proprietary format containing ladder logic, I/O configuration, and process parameters) - HMI manipulation: Confirmed falsification of HMI display values — changing the readings shown to operators without altering actual process conditions
Targeted PLC Models and Attack Methods
Rockwell Automation — Allen-Bradley CompactLogix and Micro850
Initial access obtained via the EtherNet/IP protocol, which provides remote programming and monitoring capabilities. Attackers used the protocol legitimately to read and extract project files before modifying controller configurations.
Key risk: Allen-Bradley CompactLogix controllers are widely deployed for process automation in water treatment, HVAC, and manufacturing. Direct internet exposure of the EtherNet/IP port (TCP 44818) is the primary vulnerability.
Schneider Electric — Modicon M340 (BMX P34)
Targeting via the UMAS (Unified Messaging Application Services) protocol, Schneider Electric’s proprietary protocol used for PLC programming and monitoring. The advisory documents exploitation of unauthenticated UMAS commands available in firmware versions prior to vendor patches issued in 2025.
Key risk: UMAS authentication gaps in older Modicon firmware allow unauthenticated read and write access to controller memory regions. Field deployments in water and energy sectors have historically lagged on firmware updates due to change management processes and operational availability requirements.
Siemens S7-1200
Targeting via the S7comm protocol (ISO-on-TCP, port 102), Siemens’ legacy programming protocol. The July 2026 update adds S7-1200 targeting to the advisory’s scope. S7comm exploitation has been documented in academic research since 2011 but remains viable in operational deployments where S7 Security Level 1 (default) is in use and direct Ethernet access to the PLC is available.
Key risk: S7-1200 is one of the most widely deployed entry-level Siemens PLCs globally, used across manufacturing, water treatment, and building automation. Default S7 Security Level 1 provides no authentication; Level 2 and Level 3 require explicit configuration.
Observed Operational Impact
The advisory documents two categories of confirmed operational impact:
System outages and financial losses affecting victims that experienced unplanned process interruptions following PLC configuration changes. Small water utilities operating with limited OT security monitoring capacity were disproportionately affected.
HMI display falsification — the advisory explicitly notes that attackers modified HMI display readings without changing actual process conditions in at least some confirmed incidents. This is a significant escalation: operators viewing falsified process data cannot make informed control decisions, creating the conditions for either dangerous manual intervention or process anomalies going undetected while the control system shows normal readings.
Immediate Defensive Actions
The advisory identifies three categories of immediate action for affected asset owners:
1. Remove Internet Exposure
Internet-facing PLCs and HMIs represent the primary attack vector. Any PLC or associated HMI accessible from the public internet — without a VPN, jump host, or OT-specific remote access solution in the path — is directly exposed.
# Identify internet-facing industrial services — run from an external scanning perspective
# (or use Shodan/Censys queries from within your asset management programme)
# EtherNet/IP: TCP 44818
# S7comm: TCP 102
# UMAS/Modbus: TCP 502
# BACnet: UDP 47808
# Shodan query examples for asset discovery audit:
# port:44818 org:"your-org-name" — Allen-Bradley EtherNet/IP
# port:102 org:"your-org-name" — Siemens S7
# port:502 org:"your-org-name" — Modbus2. Apply Vendor Authentication Hardening
Siemens S7-1200: Configure S7 Security Level 3 (password protection for all access types). Upgrade to TIA Portal V18+ which supports TLS-secured S7 communication. Reference: Siemens Security Advisory SSA-986695.
Schneider Modicon M340: Apply firmware update v02.50 or later addressing the unauthenticated UMAS vulnerability. Enable Ethernet module access control lists to restrict UMAS connections to authorised engineering workstations by IP address.
Rockwell CompactLogix: Enable controller security using Studio 5000 Logix Designer to require password authentication for all EtherNet/IP programming connections. Apply Rockwell Advisory PN1662 patches.
3. Enable Change Detection and Audit Logging
PLC project file changes — modifications to ladder logic, I/O configuration, or process parameters — should generate alerts. Most industrial historians and SCADA platforms can be configured to alert on controller program version changes.
# Example Claroty/Dragos detection recommendation:
# - Alert on: PLC project file write operations outside change windows
# - Alert on: HMI value changes without corresponding sensor value changes (falsification indicator)
# - Alert on: New engineering workstation IP connecting to PLC over S7comm or EtherNet/IPConnection to 2023 CyberAv3ngers and Broader Iranian OT Targeting
The advisory connects this campaign to CyberAv3ngers (also tracked as Cyber Av3ngers), an Iranian Revolutionary Guard Corps-affiliated group that has conducted OT-targeting operations since at least 2022. The group maintains public Telegram channels and has been linked to attacks on Israeli industrial targets alongside U.S. operations.
The expansion from Unitronics (Israeli vendor) to global-vendor PLCs (Rockwell, Schneider, Siemens) indicates a strategic shift from target-specific to sector-specific targeting — the goal is disruption of U.S. critical infrastructure regardless of equipment origin.
The July 2026 Treasury co-signatory addition suggests the department may be preparing designations against individuals or entities associated with the campaign, consistent with U.S. government practice of pairing advisory publication with sanctions for significant OT targeting campaigns.
Sector-Specific Recommendations
Water and Wastewater Utilities: The EPA co-authorship reflects the concentrated exposure in this sector. Utilities should prioritise asset discovery to identify any internet-facing PLCs, contact WaterISAC for threat-specific indicators, and review the EPA’s Incident Action Checklist for Small Drinking Water Systems.
Energy Sector: DOE co-authorship reflects energy sector targeting. Energy OT operators should engage their E-ISAC membership for sector-specific indicators and review NERC CIP compliance status for remote access controls affecting BES Cyber Systems.
Municipal Government: Government facilities sector targeting includes building automation systems (HVAC, access control, fire suppression). Physical security managers and IT teams may be unaware that their building management systems use PLCs susceptible to this campaign.