CISA Warns of Iranian Attacks on Water & Energy Sector PLCs

Originally published on CyberNetSec.

Executive Summary

On July 27, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and other federal agencies issued a critical advisory about an ongoing campaign by Iran-affiliated threat actors targeting U.S. critical infrastructure. The actors are specifically targeting internet-exposed programmable logic controllers (PLCs) within the water and energy sectors. The advisory warns that these actors can manipulate controller logic, which could lead to physical disruption of essential services. Their capabilities include falsifying operator displays to hide their actions and disabling safety functions, posing a direct threat to the safe operation of industrial control systems (ICS) and SCADA equipment. This campaign highlights a persistent and escalating threat from nation-state actors against the operational technology (OT) that underpins national critical functions.

Threat Overview

The campaign represents a direct threat to the physical processes managed by industrial controllers. Unlike traditional IT attacks that focus on data theft, these attacks aim to cause disruption or destruction in the physical world. The threat actors, linked to the Iranian government, are systematically scanning for and compromising PLCs that are improperly exposed to the internet. Their demonstrated capabilities are particularly alarming:

• Manipulation of Controller Logic (T0831): Changing the code on the PLC to alter the industrial process, for example, by changing pressure levels or flow rates in a water system.
• Falsification of Displays (T0816): Manipulating the human-machine interface (HMI) to show normal operating conditions while the underlying process is being dangerously altered.
• Disabling Safety Functions: Turning off alarms or automated shutdown systems that are designed to prevent catastrophic failures.

This combination of TTPs allows the attackers to cause physical effects while simultaneously preventing operators from detecting or responding to the problem.

Technical Analysis

The attack chain for this type of campaign typically involves:

1. Reconnaissance (T0861): Using tools like Shodan to identify internet-facing PLCs and other ICS/SCADA devices.
2. Initial Access (T0819): Exploiting default credentials, weak passwords, or unpatched vulnerabilities in the PLC's firmware or web interface to gain access.
3. Execution and Manipulation: Once they have access, the actors use the PLC's own engineering software or command-line interface to download malicious logic to the controller (T0843) or modify its configuration.
4. Inhibit Response: The attackers then manipulate the HMI and disable alarms to hide their actions and prevent a response from human operators (T0826).

The focus on the water and energy sectors is strategic, as disruption in these areas can have widespread public health and economic consequences.

Impact Assessment

A successful attack of this nature could have devastating real-world consequences. In the water sector, it could lead to the contamination of drinking water or the failure of wastewater treatment processes. In the energy sector, it could cause power outages or damage to expensive equipment. The ability to disable safety systems creates a risk of physical damage, environmental incidents, and even injury or loss of life. The CISA advisory serves as a national-level warning to all critical infrastructure operators to immediately assess their exposure and implement recommended mitigations to prevent such outcomes.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were published in the source articles.

Cyber Observables — Hunting Hints

Owners and operators of ICS/OT environments should hunt for:

Type	Value	Description
Network Traffic Pattern	Inbound connections to PLC management ports (e.g., 502/TCP, 44818/TCP) from the internet.	Any direct internet connection to a PLC is a major security risk and should be investigated immediately.
Log Source	PLC Audit Logs	Look for unexpected logic downloads, configuration changes, or logins from unknown source IPs.
Process Name	profinet.exe, step7.exe	The execution of PLC engineering software on unexpected systems could indicate an attacker staging a manipulation attempt.

Detection & Response

• Network Monitoring: Implement robust network monitoring at the boundary between the IT and OT networks. Use an ICS-aware IDS to detect malicious commands sent over industrial protocols. This is a form of Network Traffic Analysis.
• Asset Inventory: Maintain a complete and accurate inventory of all PLCs and other ICS assets, including their network location and firmware versions.
• Anomaly Detection: Deploy OT-specific anomaly detection tools that can identify unusual changes in process variables (e.g., pressure, temperature, flow) that might indicate a manipulation of controller logic.
• Credential Auditing: Regularly audit all credentials used for accessing PLCs and ensure that default passwords are changed.

Mitigation

• Network Isolation (M0930): The most critical mitigation is to ensure that no PLCs or other ICS devices are directly accessible from the internet. All remote access should be through a secure, multi-factor authenticated VPN that terminates in a DMZ.
• Change Default Credentials: Immediately change all default passwords on PLCs, HMIs, and other ICS hardware. Implement strong, unique passwords for each device.
• Patch Management: Develop a process for testing and applying security patches to ICS devices. While more complex than in IT environments, it is a necessary control.
• Network Segmentation (M0930): Implement robust segmentation between the IT and OT networks, and further segment the OT network to limit the impact of a breach. This aligns with D3-NI: Network Isolation.