Ongoing PLC Exploitation Against Critical U.S. Infrastructure

This threat involves active exploitation of programmable logic controllers (PLCs) in U.S. critical infrastructure by attackers who scan for internet-exposed industrial control systems. Using valid credentials and legitimate engineering software, attackers impersonate authorized technicians to gain access. Once inside, they alter controller logic and manipulate human-machine interface (HMI) displays to hide anomalies. The campaign targets multiple vendors including Rockwell Automation, Schneider Electric, and Siemens. The exploitation is based on architectural weaknesses and network exposure rather than software vulnerabilities, with attackers connecting via ports 22, 102, 502, 2222, and 44818. This ongoing campaign has resulted in confirmed operational disruptions and financial losses, marking an escalation from a similar 2023 campaign that caused minimal disruption.

Confirmed operational disruptions and financial losses have occurred in targeted sectors including government facilities, water systems, and energy infrastructure. The attackers' ability to manipulate PLC logic and operator displays can compromise the integrity and availability of critical industrial processes. The exploitation leverages architectural weaknesses and network exposure, enabling unauthorized control over industrial systems despite the use of legitimate credentials.

No specific patch or software fix is available since the exploitation leverages architectural weaknesses rather than software vulnerabilities. Organizations should review and restrict network exposure of industrial control systems, especially on ports 22, 102, 502, 2222, and 44818. Implement strong credential management and monitoring to detect unauthorized use of legitimate engineering software. Follow guidance from federal agencies' joint advisory for detailed mitigation strategies. Patch status is not yet confirmed — check the vendor advisory and federal agency updates for current remediation guidance.