U.S. agencies alert: Iran-linked actors target critical infrastructure PLCs

U.S. federal agencies (including FBI and CISA) published a joint advisory warning that Iran-affiliated APT actors—linked to groups such as CyberAv3ngers—have been targeting internet-exposed PLCs (notably Rockwell/Allen-Bradley CompactLogix and Micro850, and Unitronics devices) and manipulating project files and HMI/SCADA displays to cause operational disruptions across critical infrastructure sectors (water, energy, government services). The actors used leased overseas infrastructure and tools like Studio 5000 and Dropbear, communicated over ports including 44818, 2222, 102, 22, and 502, and are credited with compromising at least 75 devices; the advisory includes IOCs and recommends disconnecting PLCs from the internet, applying vendor guidance, enabling MFA, patching firmware, disabling unused services, monitoring OT ports, and coordinating with authorities for incident response.