CISA Urges Organizations to Remove Rockwell PLCs From Direct Internet Exposure

CISA and partner agencies are directing U.S. critical infrastructure operators to immediately remove Rockwell and other programmable logic controllers (PLCs) from direct internet exposure and to hunt for Iranian-affiliated APT activity in OT environments aggressively.

In a joint advisory first issued on April 7, 2026 and updated on July 22, 2026, the FBI, CISA, NSA, EPA, DOE, US Cyber Command–CNMF, and Treasury warn of ongoing exploitation of internet-connected OT devices, including PLCs from Rockwell Automation/Allen‑Bradley, Schneider Electric, and Siemens.

Victim organizations have reported unauthorized manipulation of PLC project files and deceptive data on HMI and SCADA interfaces, with several incidents resulting in operational disruption and direct financial loss.

The advisory ties the current campaign to a trajectory of IRGC‑CEC‑aligned operations, including the November 2023 “CyberAv3ngers” incidents that compromised at least dozens of Unitronics PLC/HMI devices in U.S.

WWS and other sectors. In those earlier attacks, threat actors deployed custom ladder logic, replacing legitimate control code with malicious logic that persists in the field and continues to be observed.

The updated 2026 guidance emphasizes that the same tradecraft living off legitimate engineering tools and modifying control logic now spans multiple vendors, amplifying systemic risk for any operator exposing OT directly to the public internet.

CISA Researchers said that, assessed as Iranian‑affiliated APTs linked to prior CyberAv3ngers activity, are deliberately pursuing disruptive effects across Government Services and Facilities, Water and Wastewater Systems (WWS), and Energy sectors.

Rockwell PLCs Removed

Malicious traffic has been observed on ports 44818 and 2222 (commonly associated with Rockwell EtherNet/IP), 102 (Siemens S7), and 502 (Modbus), as well as SSH access over port 22 to modems, including cases where Dropbear SSH is enabled for remote command and control.

Using the MITRE ATT&CK for Enterprise (v19) as a reference, the authoring agencies describe how Iranian‑affiliated actors gain initial access to misconfigured, internet‑facing PLCs via foreign‑based IP infrastructure and vendor programming suites.

Once connected, the actors exfiltrate PLC project files using legitimate tools such as Rockwell Studio 5000 Logix Designer, Schneider EcoStruxure Control Expert, and Siemens TIA Portal, then re‑deploy modified logic back to affected controllers.

The July 22 update introduces specific concern over Add‑On Instructions (AOIs) and other reusable code modules, which function as vendor‑specific analogues to function blocks or user‑defined function blocks.

At one victim site, investigators observed a malicious project file that preserved downstream ladder logic but inserted override routines that disabled shutdown and alarm logic, allowing unsafe process conditions to develop without operator alerts.

CISA’s central directive is blunt: disconnect PLCs and other OT assets from direct internet exposure and place them behind secure gateways and firewalls that enforce segmentation between IT and OT domains.

The advisory’s mitigations reinforce long‑standing ICS best practices using VPNs with strong authentication for necessary remote access, blocking unnecessary OT protocol ports, and reviewing logs for overseas IP traffic to ports 44818, 2222, 102, 502, and 22.

Operators are urged to implement controller programming protection (e.g., key switch in “run” mode where available), maintain offline, tested backups of PLC logic and configuration, and continuously monitor for unauthorized controller changes and AOI/function‑block tampering.

Indicators of Compromise

Indicator	Beginning of Actor Association	End of Actor Association
185.82.73[.]175	September 2025	February 2026
141.11.164[.]153	January 2026	June 2026
175.110.121[.]42	February 2026	March 2026
175.110.121[.]39	February 2026	March 2026
175.110.121[.]41	February 2026	March 2026
175.110.121[.]107	February 2026	February 2026
192.142.54[.]79	May 2026	June 2026
84.200.205[.]165	May 2026	June 2026
185.225.17[.]225	June 2026	July 2026
79.133.46[.]209	July 2026	July 2026
88.80.150[.]199	July 2026	July 2026
88.80.150[.]200	July 2026	July 2026
88.80.150[.]202	July 2026	July 2026

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist