🛡️ BREAKING: Iranian-Affiliated Threat Actors Actively Exploiting PLCs in U.S. Critical Infrastructure — Immediate Isolation Required
Published Sunday, June 21, 2026 at 07:03 AM PT BLUF: CISA has issued an alert confirming Iranian-affiliated cyber actors are actively exploiting internet-exposed Programmable Logic Controllers (PLCs) across U.S. critical infrastructure. Rockwell Automation/Allen-Bradley PLCs are confirmed affected. Operators must remove PLCs from direct internet exposure immediately. DETAILS Confirmed affected hardware: Rockwell Automation/Allen-Bradley manufactured PLCs. CISA indicates other PLC brands may also be at risk — scope beyond Rockwell is not yet fully confirmed. Attack vector: Direct internet exposure of PLCs is the confirmed entry point. Actors are exploiting this exposure to achieve compromise — specific CVEs or exploit methods have not been confirmed in available alert text. Threat actor attribution: Iranian-affiliated cyber actors — specific group designation not confirmed in available details. IOCs available: CISA has published Indicators of Compromise (IOCs) for log querying. Full IOC list not reproduced here — operators should retrieve directly from CISA advisory. Sector targeting: U.S. critical infrastructure broadly — specific sectors (water, energy, manufacturing, etc.) not confirmed in available alert excerpt. IMPACT Who is affected: U.S. critical infrastructure operators running internet-exposed PLCs, with confirmed risk to Rockwell Automation/Allen-Bradley deployments. Potential exposure extends to operators of other PLC brands. Operational risk: Successful PLC compromise can enable disruption, manipulation, or sabotage of industrial control system (ICS) processes — physical consequences possible depending on sector. Scope: Assessed as broad given the targeting of critical infrastructure categories. Full scope of active exploitation is not yet confirmed in available details. RECOMMENDED ACTIONS Immediately remove PLCs from direct internet exposure — place behind secure gateways and properly configured firewalls. Query available logs against CISA-published IOCs — retrieve full IOC list directly from the official CISA advisory. Audit all remote access paths to ICS/OT environments; disable any unnecessary external-facing interfaces. Verify firmware integrity on affected Rockwell Automation/Allen-Bradley devices where possible. Report confirmed compromises to CISA at report@cisa.gov. SOURCES Primary: CISA Alert — Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across U.S. Critical Infrastructure Full advisory and IOCs: cisa.gov ⚠️ Note: Alert excerpt provided was partial. Details on specific CVEs, targeted sectors, and full IOC list are sourced directly from CISA. Operators should consult the complete advisory before drawing conclusions on scope. ...