Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

CISA warns that Iran-affiliated APT actors are actively exploiting internet-facing OT devices—notably Rockwell/Allen-Bradley PLCs—to disrupt controllers and manipulate HMI/SCADA displays, causing operational disruption and financial loss; the advisory includes affected products, IOCs, TTPs, recommended mitigations, and guidance to remove PLCs from direct internet exposure and check logs for suspicious traffic on OT-related ports.