The point: Iran-backed hackers manipulate PLC project files to alter operational parameters and disable safety logics while operators remain unaware of the anomalies.
US security authorities document cyberattacks by Iranian state actors targeting programmable logic controllers from Siemens, Schneider Electric, and Rockwell Automation, threatening critical infrastructure in the energy, water, and government sectors.
US security authorities have released an updated security advisory on cyberattacks originating from the Iranian environment, expanding the scope of affected PLC components. Specifically, investigators report attacks on the following models: Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 (BMX P34), and Siemens S7-1200. The attackers targeted network ports 44818, 2222, 102, 502, and 22.
Attackers gain access through third-party infrastructure and manufacturer-specific programming software such as Rockwell Automation Studio 5000 Logix Designer, Schneider Electric EcoStruxure Control Expert, and Siemens TIA Portal. They download existing project files and modify the application logic. According to investigators’ findings, the manipulated files retain the original ladder logic but add new logic that overwrites specific command sets responsible for secure operational parameters. In parallel, the modifications disable critical shutdown and alarm logics, allowing systems to enter unsafe states. Additionally, attackers manipulate data displays on HMI and SCADA systems, preventing operators from noticing anomalies.
According to US government assessments, the attacks in the operational technology (OT) sector are carried out by state-backed Iranian actors operating under varying group names such as CyberAv3ngers and Handala. The target spectrum includes public administration facilities, power supply, and water and wastewater utilities.
Source: www.it-daily.net · Published 24 July 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.3.