Iran Is Hacking the PLCs That Run American Water Systems, Power Grids, and Government Facilities. Six Federal Agencies Just Published a Joint Advisory. Some Victims Have Already Lost Money and Operations.

WHAT HAPPENED

On April 7, six federal agencies published joint advisory AA26-097A, warning that Iranian-affiliated APT actors have been targeting internet-exposed PLCs across U.S. critical infrastructure since at least March 2026. The advisory was co-authored by the FBI, CISA, NSA, EPA, Department of Energy, and U.S. Cyber Command's Cyber National Mission Force. That is the largest coalition of agencies to sign a single OT advisory in recent memory. The breadth of the signatory list tells you how seriously the federal government is treating this.

The confirmed targets are Rockwell Automation and Allen-Bradley manufactured PLCs deployed in three sectors: Government Services and Facilities, Water and Wastewater Systems, and Energy. The advisory specifically names CompactLogix and Micro850 PLC devices as targets. CNN reported that multiple U.S. oil, gas, and water sites have been disrupted in recent weeks. The FBI confirmed that this activity has resulted in both operational disruption and financial loss at multiple organizations.

The attackers are not using zero-days. They are exploiting an authentication bypass vulnerability (CVE-2021-22681) that was disclosed in 2021. Five years later, devices running this vulnerability are still exposed to the public internet. Nozomi Networks' field CISO Markus Mueller told Cybersecurity Dive that more than 3,000 Rockwell devices remain visible online, either because organizations do not know they are exposed or because they underestimate the risk.

HOW THE ATTACK WORKS

The attackers used leased, overseas-hosted infrastructure and Rockwell Automation's own Studio 5000 Logix Designer software to establish accepted connections to victim PLCs. This is the legitimate configuration tool that operators use to program and manage these controllers. The attackers connected the same way an authorized engineer would, using the authentication bypass to skip the credential check.

Once connected, the FBI identified two primary activities. First, the attackers extracted the device's project file, which contains the complete logic that controls the physical process the PLC manages. Whether that is water treatment chemical dosing, power distribution switching, or facility environmental controls, the project file is the blueprint for everything the controller does. Second, the attackers manipulated data on HMI and SCADA displays, which are the operator interfaces that show staff what the physical systems are doing. When an attacker controls what operators see on their screens, they control the operator's understanding of reality.

The advisory also notes inbound scanning on ports 44818, 2222, 102, 22, and 502. Port 102 is associated with the Siemens S7 protocol and port 502 with Modbus. The inclusion of these ports means the same actors may be targeting devices from other OT vendors beyond Rockwell. The attackers also deployed Dropbear, a lightweight SSH server, on victim endpoints for persistent remote access through port 22.

ATTACK CHAIN

THIS IS AN ESCALATION

This is not the first time Iranian actors have targeted U.S. water systems. In November 2023, CyberAv3ngers, an IRGC-affiliated group, compromised at least 75 Unitronics PLC devices, including the Municipal Water Authority of Aliquippa in western Pennsylvania. That campaign used default passwords on Israeli-manufactured Unitronics controllers.

The current campaign is broader in scope, more technically capable, and hitting a wider set of sectors. Check Point Research confirmed that identical targeting patterns appeared against Israeli PLCs in March 2026 before the U.S. advisory was issued, indicating a coordinated multi-front operation. The escalation tracks with a broader shift in Iranian cyber activity following the U.S.-Israeli military strikes on Iran's nuclear facilities and military infrastructure on February 28, 2026.

The timing also creates a policy collision that we documented yesterday on this blog. The White House has proposed cutting CISA's budget by $707 million and eliminating the stakeholder engagement offices that coordinate with water districts and local government operators. The SafeState analysis noted that approximately 60% of CISA's workforce was furloughed beginning February 14, reducing the agency's capacity at the precise moment Iranian cyber activity intensified. The organizations this advisory is trying to reach are the same organizations that are losing their primary point of federal support.

ADVISORY DETAILS AND IOCS

DEFENSE TAKEAWAYS