- CISA, FBI and EPA have updated a joint cybersecurity advisory on Iran-linked threat activity
- New guidance targets malicious PLC code changes and expands the manufacturers covered
- The 2026 Homeland Security Summit will examine AI, cyber defense and more
The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, FBI, the Environmental Protection Agency and other government partners have issued an update to a joint cybersecurity advisory warning of Iran-affiliated cyber actors exploiting programmable logic controllers, or PLCs, across U.S. critical infrastructure.
As threats to the nation’s critical infrastructure continue to evolve, government and industry leaders will gather at the Potomac Officers Club’s 2026 Homeland Security Summit on Nov. 12 to discuss AI, cyber defense, border security and operational capabilities at major DHS agencies. Register now to join the conversation shaping the future of homeland security.
CISA said Wednesday the update to the advisory issued in April responds to ongoing Iranian cyber activity aimed at internet-connected operational technology devices. The update includes new indicators of compromise, detection guidance and additional mitigation steps.
What Does the Updated Advisory Cover?
The updated cybersecurity advisory offers new guidance for detecting malicious changes in reusable code modules used in Rockwell Automation PLC programs. It also broadens the advisory’s scope beyond Rockwell Automation, noting that Schneider Electric and Siemens, along with other PLC manufacturers, have also been targeted. CISA said the wider scope highlights why operational technology owners and operators need to limit direct internet access and secure PLC deployment.
What Has the Iran-Affiliated Activity Targeted?
According to the advisory, threat actors have disrupted PLCs across U.S. critical infrastructure sectors, leading to operational disruptions and financial losses for affected organizations. The actors attempted to download malicious project files and alter data on human machine interfaces and supervisory control and data acquisition displays. Targeted sectors include water and wastewater systems, energy, local municipalities, and other government services and facilities.
What New Mitigations Are Recommended?
The updated advisory recommends that organizations take the following additional steps:
- Consult PLC manufacturers’ existing guidance to help secure operational technology deployments
- Tightly restrict network access to PLC devices
- Check project files on PLCs for unauthorized modifications
- Keep service providers informed of active threats aimed at internet-connected PLC devices
What Did Federal Officials Say About the Cyberthreat?
Chris Butera, CISA’s acting executive assistant director for cybersecurity, said the agency has repeatedly cautioned critical infrastructure stakeholders that threat actors linked to Iran are targeting poorly secured, internet-connected accounts and devices. He called on organizations to consult the updated advisory and put the recommended actions in place.
Brett Leatherman, assistant director of the FBI’s cyber division, said Iranian cyber actors remain focused on U.S. critical infrastructure and that the bureau continues working to identify and disrupt that activity.
“This advisory provides network defenders with the information they need to identify malicious activity, strengthen their defenses, and reduce opportunities for Iranian cyber actors to disrupt the essential services Americans rely on,” Leatherman added.
Jess Kramer, EPA assistant administrator for water, said cyberthreats represent a significant risk to the nation’s drinking water and wastewater systems, given how many communities, businesses, hospitals and schools depend on them. She called on water systems to remain alert, stay current on emerging threats and put cybersecurity best practices into place.
What Other Recent Actions Has CISA Taken?
Beyond the PLC advisory update, CISA has pursued several other initiatives to strengthen critical infrastructure security and government-industry collaboration. The agency and four international cybersecurity partners recently issued guidance to help software manufacturers and online service providers establish coordinated vulnerability disclosure programs that support collaboration with security researchers.
CISA shared key lessons from a May cyber incident involving the unauthorized release of internal CISA Amazon Web Services GovCloud keys and other data to a public repository. The agency also established the Alliance of National Councils for Homeland Operational Resilience-Critical Infrastructure to expand information sharing and strengthen government-industry collaboration on critical infrastructure security.
In May, CISA and the FBI also issued an alert on a Russian phishing campaign targeting users of a commercial messaging application.
