Critical Alert: Iranian-Affiliated Actors Target U.S. Infrastructure via Industrial Control Systems

A coalition of U.S. federal agencies (FBI, CISA, NSA, EPA, DOE, CNMF) issued an urgent April 7, 2026 advisory warning that Iranian-affiliated APT actors are actively compromising internet-facing Rockwell Automation/Allen-Bradley PLCs (e.g., CompactLogix, Micro850) using leased overseas infrastructure and legitimate engineering tools (Studio 5000), deploying Dropbear SSH and targeting OT ports (44818, 2222, 102, 502, 22) to manipulate HMIs/SCADA displays and cause operational disruptions across Energy, Water/Wastewater, and Government facilities; the advisory provides IOCs, TTPs, and immediate mitigations (disconnect PLCs, use secure gateways/jump hosts, set physical switches to Run, monitor OT ports).