InfoSec Briefing - July 24, 2026

🎧 Audio Briefing

Playback Speed:

Cyber security developments for Friday the 24th of July 2026 covering articles added to the BlueTeamSec community on infosec.pub. Today we have 1 article to cover. All attribution is by the article authors. All article analysis is automated.

The Cybersecurity and Infrastructure Security Agency has published an alert on Iranian-affiliated actors exploiting internet-exposed programmable logic controllers across U.S. critical infrastructure — water systems, energy facilities, and government sites. The attackers are using legitimate manufacturer software from Rockwell, Schneider, and Siemens to modify device logic, extract project files, and tamper with operational displays. One for anyone managing industrial control systems or advising on OT network segmentation.

That concludes today's briefing.

📰 Articles Covered

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure - Cybersecurity and Infrastructure Security Agency

This precis summarizes the findings from CISA Advisory AA26-097a regarding the exploitation of internet-exposed Programmable Logic Controllers (PLCs).

### **What Happened**
Iranian-affiliated Advanced Persistent Threat (APT) actors have been exploiting internet-exposed PLCs to gain unauthorized access to U.S. critical infrastructure. The actors use leased, third-party infrastructure and manufacturer-specific programming software to connect to these devices. Once connected, they exfiltrate device project files, modify the logic (including Add-On Instructions), and manipulate data on Human Machine Interface (HMI) and supervisory control and data acquisition (SCADA) displays. In some instances, this has caused operational disruptions and financial loss 【1】.

### **Who Is Affected**
The campaign specifically targets U.S. critical infrastructure, including:
* **Government Services and Facilities:** Including local municipalities.
* **Water and Wastewater Systems (WWS).**
* **Energy Sector.**

The primary impact is on internet-exposed PLCs, specifically:
* **Rockwell Automation/Allen-Bradley:** CompactLogix and Micro850 series.
* **Schneider Electric:** BMX P34/Modicon M340 series.
* **Siemens:** S7-1200 series.
* *Note: Other branded or manufactured PLCs may also be at risk if exposed to the internet.* 【1】

### **Security Implications**
The manipulation of project files allows attackers to override safety logic. By disabling critical shutdown and alarm mechanisms, the actors can force systems into unsafe operating conditions without alerting operators, creating significant safety risks alongside operational and financial impacts 【1】.

### **Technical Details**
* **Access Method:** Actors use foreign-based IP addresses via leased third-party infrastructure to connect directly to internet-facing devices.
* **Tools:** They utilize legitimate manufacturer programming software, such as Rockwell Automation’s Studio 5000 Logix Designer, Schneider Electric’s EcoStruxure Control Expert, and Siemens’ TIA Portal.
* **Targeted Ports:** Malicious traffic has been observed targeting ports `44818`, `2222`, `102`, and `502`, as well as port `22` for modems 【1】.

### **What Defenders Should Know**
CISA and the FBI recommend immediate action to secure OT environments:
* **Remove Internet Exposure:** Disconnect PLCs from the public internet. Use secure gateways (jump hosts), VPNs, or ZTNA for remote access rather than direct connections 【1】.
* **Physical Controls:** If a device has a physical mode switch, keep it in the "Run" position to block remote programming changes 【1】.
* **Hardening:** Change default passwords to complex, unique credentials and disable unused services like Telnet, FTP, RDP, and VNC 【1】.
* **Verification:** Regularly audit running PLC logic against known-good baselines to identify unauthorized modifications to Add-On Instructions (AOIs) or other code 【1】.
* **Monitoring:** Implement firewall rules to block unauthorized IPs and monitor network traffic for unexpected protocols or unauthorized mode-change commands 【1】.