Iran-linked crews are probing more flavors of US industrial kit

CISA expanded an advisory after observing Iranian-affiliated APTs targeting internet-facing PLCs (initially Rockwell/Allen-Bradley, now including Schneider Electric, Siemens and others) used in critical infrastructure; actors leveraged open ports and Dropbear SSH on victim modems to gain access, exfiltrate project files, and modify or delete logic — including disabling shutdowns and alarms — potentially allowing unsafe conditions. Authorities recommend disconnecting PLCs from public internet access, isolating architectures, auditing project files for unauthorized changes, changing defaults, and notifying service providers.