Multiple federal agencies have updated a joint advisory warning of active exploitation targeting programmable logic controllers (PLCs) in U.S. critical infrastructure. Attackers scan for internet-exposed industrial control systems and connect using legitimate engineering software with valid credentials, appearing as authorized technicians. Once inside, they alter controller logic and manipulate operator displays to hide anomalies. The campaign has expanded beyond Rockwell Automation to include Schneider Electric and Siemens equipment. Unlike a similar 2023 campaign that caused minimal disruption, this ongoing activity has resulted in confirmed operational disruption and financial losses. Targeted sectors include government facilities, water systems, and energy infrastructure. The exploitation leverages architectural weaknesses rather than software vulnerabilities, with attackers accessing systems through ports 22, 102, 502, 2222, and 44818.

Indicators of Compromise

• hash: 95bd07b4400095acdafce05888da27228d7d07ca
• hash: 95bd07b4400095acdafce05888da27228d7d07ca
• ip: 79.133.46.209
• hash: 366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb
• hash: 366e435a1ea0f597deb6ebe7c0c5acdb6e8b33eb
• domain: ocferda.com
• domain: ocferda.com
• domain: tylarion867mino.com
• domain: tylarion867mino.com
• domain: uuokhhfsdlk.tylarion867mino.com
• domain: uuokhhfsdlk.tylarion867mino.com
• ip: 185.82.73.162
• ip: 185.82.73.164
• ip: 185.82.73.171
• ip: 135.136.1.133
• ip: 185.82.73.165
• ip: 185.82.73.167
• ip: 185.82.73.168
• ip: 185.82.73.170
• ip: 175.110.121.107
• ip: 175.110.121.39
• ip: 175.110.121.42
• ip: 185.82.73.175
• ip: 185.225.17.225
• ip: 185.225.17.225
• ip: 141.11.164.153
• ip: 192.142.54.79
• ip: 84.200.205.165
• ip: 88.80.150.199
• ip: 88.80.150.200
• ip: 88.80.150.202