Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

CISA has published a Cybersecurity Advisory (AA26-097a) detailing ongoing exploitation of programmable logic controllers (PLCs) by Iranian-affiliated cyber actors. The advisory warns that these actors are compromising US-based critical infrastructure by exploiting default credentials and poorly protected internet-facing PLCs. The activity is assessed as part of a broader targeting campaign.

The advisory primarily affects US organizations within critical infrastructure sectors, specifically those utilizing operational technology (OT) and industrial control systems (ICS). Entities in the Water and Wastewater Systems, Energy, and Manufacturing sectors are explicitly highlighted as targets. Any organization using affected PLC models, particularly from Unitronics, should consider themselves within scope.

Compliance teams should immediately review this advisory and disseminate it to operational technology and security personnel. The next steps involve identifying and inventorying all internet-facing OT assets, enforcing strong password policies beyond defaults, and implementing network segmentation controls as per the provided mitigation guidance. Teams should integrate these actions into existing CER compliance and incident response planning.