Hackers with ties to Iran are targeting publicly accessible Rockwell/Allen-Bradley PLCs found in the infrastructure networks of American organizations deemed critical.

This warning was issued earlier today in a collaborative announcement from several agencies: the FBI, CISA, NSA, EPA, DOE, and the United States Cyber Command – Cyber National Mission Force (CNMF).

These agencies reported that these ongoing attacks have impacted various critical infrastructure sectors in the U.S. (including government services, water systems, and energy), causing financial damage and disrupting operations since March 2026.

“The FBI believes that a group of APT actors with Iranian connections are targeting PLCs that are accessible via the internet, aiming to create disruptions. This includes actions like tampering with project files and manipulating data shown on HMI and SCADA displays, all directed at U.S. critical infrastructure entities,” according to the advisory.

“Recently, Iranian-affiliated APT groups have increased their targeting of U.S. organizations, likely as a response to tensions between Iran, the United States, and Israel.”

“The FBI discovered that this activity resulted in the extraction of the PLC project file and the manipulation of data displayed on HMI and SCADA systems,” the U.S. agencies stated.

A similar warning released in November 2023 alerted to the CyberAv3ngers group, linked to the Iranian Government Islamic Revolutionary Guard Corps (IRGC), taking advantage of weaknesses in Unitronics operational technology (OT) systems located in the U.S.

Between November 2023 and January 2024, CyberAv3ngers successfully breached at least 75 Unitronics PLC devices through multiple cyberattacks, with half of these devices being part of critical water and wastewater infrastructure networks.

To protect against these attacks, it’s advised to disconnect PLC devices from the internet or protect them with a firewall, review logs for compromise indicators included in the current joint advisory, and check for suspicious traffic on OT communication ports, particularly traffic originating from foreign hosting providers.

It’s also recommended to enable multifactor authentication (MFA) for accessing the OT network, ensure PLCs have the latest firmware updates, disable any unneeded services and authentication methods (like default keys), and monitor network activity for anything unusual.

Last month, the Handala hacktivist group, linked to Iran and supportive of Palestine, wiped data from around 80,000 devices on the U.S. medical company Stryker’s network, encompassing employee mobile devices and company-managed computers.

The FBI has also cautioned that Iranian hackers connected to the country’s Ministry of Intelligence and Security (MOIS) are using Telegram to facilitate malware attacks.