# Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

Iranian-affiliated APT actors accessed internet-exposed, misconfigured PLCs with vendor programming software, downloaded malicious project files that disabled shutdown/alarm logic, disrupting US critical infrastructure.

- Payout: Real-world hack
- Severity: high
- Program: Rockwell Automation
- Analysis by: CISA
- Disclosed: 2026-04-06
- Write-up quality: 6/10
- Original: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a
- Library page: https://bugbountylibrary.com/r/blog%3Acisa-gov-news-events-cybersecurity-advisories-aa26-097a
- Tags: area:devices domain:infra domain:iot impact:dos impact:integrity kind:incident platform:threat-intel sev:high tech:linux technique:default-creds vuln:access-control vuln:misconfiguration

**Target:** Internet-exposed PLCs (Rockwell CompactLogix/Micro850, Schneider M340, Siemens S7-1200) and cellular modems
**Root cause:** PLCs were directly internet-exposed and misconfigured without network/hardening controls, allowing actors using vendor PLC programming software over leased third-party infrastructure to connect and modify project files.
**Steps:**
1. Identify internet-facing PLCs on ports 44818, 2222, 102, 502 (and modems on port 22) via leased third-party hosted infrastructure.
2. Connect to the misconfigured PLC using manufacturer programming software (Studio 5000 Logix Designer, EcoStruxure Control Expert, TIA Portal).
3. Exfiltrate device project files to actor-controlled infrastructure over the C2 channel.
4. Modify/delete project file logic including Add-On Instructions (AOIs), retaining downstream ladder logic but overriding instruction sets that maintain safe operating parameters.
5. Download the malicious project file to the targeted PLC via configuration software.
6. Manipulate data displayed on HMI/SCADA displays and disable critical shutdown and alarm logic so systems enter unsafe conditions without operator notification.
**How found:** FBI/CISA observed inbound malicious traffic to OT ports from foreign hosting providers and analyzed victim project files, finding modified/deleted AOI logic and altered HMI/SCADA data.
**Exploitation:** Actors used leased third-party hosted infrastructure and vendor PLC programming software to reach misconfigured internet-exposed PLCs, exfiltrated project files, then downloaded modified project files that preserved downstream ladder logic but overrode safe-operating-parameter instruction sets and disabled shutdown/alarm logic, causing operational disruption and financial loss at US victims.
**Escalation:** In one instance actors deployed Dropbear SSH on victim modems to gain remote access via port 22; targeting expanded from Rockwell to Schneider Electric and Siemens PLCs.
**Insight:** Internet-exposed PLCs on ports 44818/2222/102/502 are directly programmable with vendor engineering software; check AOIs and reusable code modules for logic that preserves downstream function while overriding safety-parameter instructions, since such tampering survives casual review.