On July 22, 2026, CISA updated advisory AA26-097A, “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure.” It is worth reading in full if you run a plant, but here is the short version and what to do about it.

What the advisory says

CISA and its partner agencies are warning that Iranian-affiliated actors are actively targeting internet-connected operational technology, specifically programmable logic controllers (PLCs), across several US critical infrastructure sectors. According to the advisory, these actors have disrupted PLCs through malicious project file interactions and by manipulating the data shown on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss.

The July update matters for two reasons. First, it expands the scope. What started as Rockwell Automation / Allen-Bradley targeting now explicitly includes Schneider Electric, Siemens, and potentially other branded PLCs. CISA’s guidance now covers “potentially all internet exposed PLCs.” Second, it adds detection guidance for malicious changes to reusable code modules inside Rockwell PLC programs, along with indicators of compromise you can hunt for in your logs.

Why this one deserves your attention

Plenty of security advisories are about data theft. This one is about something more serious: manipulation of the systems that run physical processes. When an attacker can reach a PLC, alter its logic, and change what operators see on their HMI and SCADA screens, the risk is not just downtime. It is the possibility that alarms and shutdown functions are quietly disabled while the display shows everything is normal. That is a safety problem as much as a security one, and it is exactly the kind of scenario OT security exists to prevent.

These are also, by CISA’s description, largely opportunistic. The actors are scanning broadly for exposed OT and going after whatever answers. That means the deciding factor is not whether your company is a marquee target. It is whether one of your controllers is reachable from the public internet.

The uncomfortable part: you may be exposed without knowing it

The single most common reaction we see to advisories like this is “we’re not exposed.” Often that turns out to be optimistic. Controllers get connected to the internet for convenient remote access, by an integrator during a project, or through a cellular modem or misconfigured firewall rule that nobody documented. Internet-wide scanning services can and do find these devices, and so can the actors CISA is describing. The only way to know is to look, deliberately, rather than assume.

This is the “understand your attack surface” step, and it is the honest starting point. You cannot protect a device you do not know is reachable.

What to do now

CISA’s recommended actions map cleanly onto sound OT security practice. In priority order:

  1. Get PLCs off the public internet. No controller should be directly reachable from the internet. Put it behind a properly configured firewall and a secure gateway, and use controlled, authenticated remote access instead of direct exposure. If you rely on integrators for remote support, involve them in doing this correctly rather than leaving a door open for convenience.

  2. Find out what is actually exposed. Inventory your OT devices and check what can be reached from outside. Treat “we don’t think we have exposed devices” as a hypothesis to test, not a conclusion. This is a great prompt for a focused threat hunt.

  3. Check your logs for the specific ports. CISA calls out suspicious traffic on the OT-associated ports 44818, 2222, 102, and 502, especially traffic originating from foreign hosting providers. The advisory provides downloadable indicators of compromise (STIX) you can load into your tooling to hunt for known-bad activity.

  4. Validate your project file logic against a known-good baseline. Because this campaign manipulates project files and, on Rockwell devices, reusable code modules, compare what is running on your controllers against a trusted copy. If you do not have a known-good baseline, creating one is worth doing regardless.

  5. Set the physical mode switch to Run, not Remote. For Rockwell Automation devices, CISA recommends placing the controller’s physical mode switch in the Run position, so that logic changes require someone physically at the controller rather than a remote actor.

  6. Segment IT from OT. Underneath all of this is the structural fix: the plant floor should not share a flat network with corporate IT or the internet. Proper IT/OT segmentation is what keeps a phished laptop, or an internet scan, from ever reaching a controller in the first place.

This is the work, not a special project

The reason we spend so much time on OT is that manufacturing IT is not office IT, and advisories like AA26-097A are exactly why. Generalist providers rarely touch PLCs, SCADA, or the boundary between the plant floor and the corporate network, which is precisely where this threat lives. Getting controllers off the internet, segmenting the network, monitoring the right ports, and maintaining known-good baselines are ongoing disciplines, not a one-time cleanup.

If you are not certain whether any of your controllers are reachable from the internet, or whether the ports above are showing traffic they should not, that uncertainty is the thing to resolve first. NBIT works at the IT/OT boundary and provides the cybersecurity monitoring behind it for manufacturers and other operators who cannot afford a controller to be someone else’s opportunity. Reviewing your OT exposure against this advisory is a good, concrete place to start.

Source: CISA Cybersecurity Advisory AA26-097A, “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure,” originally published April 7, 2026 and last updated July 22, 2026.