Iranian threat actors have been actively compromising internet-exposed industrial controllers in the United States, altering mechanisms responsible for alarms and safety shutdowns in critical infrastructure environments.
The attacks have affected government organizations and operators in the water, sanitation, and energy sectors. Activity has been observed at least since March 2026 and has already caused operational interruptions and financial losses for some victims.
Attackers search for equipment with insecure remote access, weak credentials, or default configurations. Targeted devices include Rockwell CompactLogix and Micro850 controllers, Schneider BMX P34 and Modicon M340 PLCs, as well as Siemens S7-1200 models.
No evidence indicates the use of previously unknown vulnerabilities. Instead, operators leverage rented infrastructure abroad and legitimate industrial programming software to connect to target environments.
Once inside, the actors download PLC projects, modify the control logic, and upload the altered files back to the devices. In one documented incident, the malicious project kept part of the process running while adding instructions that allowed operations to exceed safe limits.
Attackers also modified data presented on HMI interfaces and SCADA systems. The techniques closely resemble earlier campaigns associated with the CyberAv3ngers group, which is linked to Iran’s Islamic Revolutionary Guard Corps, although direct attribution has not been confirmed.
