Iranian Threat Actors Disrupt US Critical Infrastructure via Exposed PLCs

US and partner agencies warn that Iran-affiliated APT actors are conducting an active campaign against Internet-exposed OT devices — notably Rockwell/Allen‑Bradley PLCs (CompactLogix, Micro850) — across energy, water/wastewater, and government sectors, manipulating PLC project files and HMI/SCADA displays and causing some operational disruption and financial loss; attackers used leased overseas infrastructure and Rockwell Studio 5000 to establish connections, deployed Dropbear SSH, targeted ports including 44818/2222/102/22/502, and CISA published IoCs and mitigation guidance such as removing PLCs from direct Internet exposure.