US Warns of Iranian Attacks on Siemens & Schneider ICS Devices
Iranian Hackers Expand Attacks to Siemens, Schneider Industrial Systems
Related Entities
Threat Actors
Organizations
Products & Tech
Full Report
Executive Summary
On July 22, 2026, U.S. federal agencies, including CISA, the FBI, and the EPA, updated a joint cybersecurity advisory warning of an expanded campaign by Iranian-affiliated cyber actors against U.S. critical infrastructure. The threat actors are targeting internet-exposed operational technology (OT) devices, specifically programmable logic controllers (PLCs). The campaign, initially focused on Rockwell Automation products, has now been observed targeting PLCs from Schneider Electric and Siemens. The attackers are leveraging legitimate engineering software to connect to misconfigured devices, manipulate control logic, and disrupt physical processes, posing a direct threat to public safety and national security. The advisory urges OT asset owners to immediately remove PLCs from the public internet and implement robust security controls.
Threat Overview
The threat actors, linked to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC), are systematically scanning the internet for exposed OT devices. Their targets now include Schneider Electric Modicon M340, Siemens S7-1200, and Rockwell Automation CompactLogix and Micro850 PLCs. The primary attack vector is the exploitation of misconfigured devices that are directly accessible from the internet, often with default credentials or weak security settings.
Once a target is identified, the actors use legitimate, publicly available software—such as Rockwell's Studio 5000 Logix Designer, Schneider's EcoStruxure Control Expert, and Siemens' TIA Portal—to connect to the PLC. This 'living off the land' approach makes detection difficult, as the network traffic can appear benign. After gaining access, they download malicious project files that alter the PLC's logic to create unsafe operating conditions, disable safety and alarm functions, and manipulate data on HMI/SCADA displays to deceive operators.
Technical Analysis
The campaign demonstrates a clear understanding of OT systems and their control software. The actors are not exploiting software vulnerabilities but rather fundamental security weaknesses in network architecture and device configuration.
Attack Pattern:
- Reconnaissance (T0885): Actors scan the internet for specific PLCs listening on common OT ports, including
44818(EtherNet/IP),102(ISO-TSAP for Siemens S7), and502(Modbus TCP). - Initial Access (T0867): Actors connect to internet-exposed PLCs using default or weak credentials via legitimate engineering workstations running vendor software.
- Inhibit Response Function (T0826): The attackers download modified project files to the PLC. This malicious logic is designed to override safety interlocks and disable automated shutdown procedures.
- Manipulation of View (T0839): The actors manipulate data presented on HMI and SCADA systems, causing operators to see normal values while the physical process enters a hazardous state.
- Impact (T0828): The ultimate goal is to cause physical disruption, equipment damage, or unsafe conditions in critical infrastructure sectors like water and energy.
The group behind these attacks shares TTPs with actors tracked as CyberAv3ngers, Shahid Kaveh Group, and Hydro Kitten (Storm-0784).
Impact Assessment
The potential impact of this campaign is severe. By targeting the core control elements of industrial processes, the attackers can cause tangible physical consequences. In the water and wastewater sector, this could lead to the discharge of untreated water or the manipulation of chemical dosing, posing a public health risk. In the energy sector, it could result in power outages or equipment damage. The disruption to government facilities could impact essential services. The financial losses from operational downtime and equipment repair are significant, but the primary risk is to public safety and the integrity of U.S. critical infrastructure.
IOCs — Directly from Articles
The source articles mentioned network ports but no specific IP addresses, domains, or file hashes.
- TCP Port:
44818(EtherNet/IP for Rockwell) - TCP Port:
2222 - TCP Port:
102(ISO-TSAP for Siemens) - TCP Port:
502(Modbus TCP)
Cyber Observables — Hunting Hints
Security teams should hunt for the following patterns to identify potential targeting or compromise:
LogixDesigner.exe, ControlExpert.exe, tia.exe*.ACD, *.STU, *.ap*Detection & Response
Detection:
- Network Monitoring: Implement robust monitoring of all traffic to and from the OT network. Baseline normal communication patterns and alert on any deviations, especially connections from external IP addresses to PLCs. D3FEND Technique: Network Traffic Analysis (D3-NTA).
- Asset Inventory: Maintain a complete and accurate inventory of all OT assets, including their network exposure. Use tools like Shodan to proactively identify your organization's exposed devices.
- Log Analysis: Collect and analyze logs from firewalls, VPNs, and OT devices themselves. Look for login failures, configuration changes, and project downloads from unauthorized sources. D3FEND Technique: System File Analysis (D3-SFA).
Response:
- If unauthorized access is detected, immediately disconnect the affected PLC from the network.
- Restore the PLC to a known-good state from a verified backup.
- Change all default and weak passwords on OT devices.
- Preserve logs and device images for forensic analysis.
Mitigation
Strategic Mitigation:
- Network Segmentation (M0930): The most critical mitigation is to remove all OT devices, especially PLCs, from the public internet. Implement a proper Purdue Model network architecture with a DMZ separating IT and OT networks. All remote access should be brokered through a secure, multi-factor authenticated VPN. D3FEND Technique: Network Isolation (D3-NI).
- Privileged Account Management (M1026): Strictly control access to engineering workstations and PLC management software. Use strong, unique passwords for all OT devices and disable default accounts. D3FEND Technique: Strong Password Policy (D3-SPP).
- Asset Hardening: Change default passwords, disable unnecessary ports and services, and apply the latest firmware updates to all PLCs and OT devices.
Timeline of Events
MITRE ATT&CK Mitigations
The most critical defense is to ensure PLCs and other OT devices are not exposed to the internet. Segment the OT network from the IT network.
Implement secure remote access solutions with multi-factor authentication instead of direct internet exposure.
On engineering workstations, use application control to restrict which programs can run and make network connections.
Enforce strong, unique passwords for all OT devices and applications. Disable default accounts.
D3FEND Defensive Countermeasures
The primary cause of these incidents is the direct exposure of PLCs to the public internet. The most effective countermeasure is to implement strict network isolation. OT networks should be air-gapped from IT networks or, at a minimum, segmented behind a properly configured firewall and DMZ, following the Purdue Model. No PLC should have a publicly routable IP address. All remote access to the OT environment must be brokered through a secure gateway, such as a VPN with multi-factor authentication, that terminates in the IT network or a DMZ. From there, access to the OT network should be further restricted to specific engineering workstations. This prevents threat actors from scanning for and directly connecting to PLCs from the internet, effectively removing the initial access vector used in this campaign.
Even with network isolation, strong authentication is critical. The Iranian actors are known to use default or weak credentials. Organizations must enforce a strong password policy for all OT devices, including PLCs, HMIs, and engineering workstations. This involves changing all default passwords immediately upon device deployment to long, complex, and unique passwords. Where possible, integrate authentication with a centralized management system like Active Directory, but ensure the security of the directory itself. For devices that do not support complex passwords, compensating controls like network access control lists (ACLs) should be used to restrict access to only authorized engineering workstations. Disabling or renaming default administrative accounts is also a crucial step in hardening these devices against unauthorized access.
While the primary goal is to prevent inbound connections, controlling outbound traffic from the OT network provides another layer of defense. Configure firewalls to deny all outbound internet traffic from the OT network by default. Only allow specific, necessary connections to vendor update sites or other trusted destinations. This can prevent a compromised PLC or engineering workstation from establishing a reverse shell or connecting back to an attacker's command and control server. In the context of this campaign, where attackers use legitimate software, filtering outbound traffic could disrupt their ability to download malicious project files from an external source or receive commands, providing an opportunity for detection and response.
Timeline of Events
CISA and partners issue initial advisory on Iranian actors targeting Rockwell Automation PLCs.
CISA and partners update the advisory, expanding the scope to include Schneider Electric and Siemens PLCs.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.