An updated US federal advisory details Iranian APT groups targeting ICS devices from Siemens, Schneider Electric, and Rockwell Automation. Attackers exploited internet-exposed PLCs by downloading malicious project files via vendor programming software (Rockwell Studio 5000 Logix Designer, Schneider EcoStruxure Control Expert, Siemens TIA Portal). These files retained legitimate ladder logic but added malicious instructions overriding safety controls, disabling shutdown and alarm logic, and manipulating HMI/SCADA data. Targeted PLC models include Rockwell CompactLogix and Micro850, Schneider Modicon M340 (BMX P34), and Siemens S7-1200 series. Attackers connected over ports 44818, 2222, 102, 502, and 22 using leased third-party infrastructure. The advisory provides updated detection techniques and IoCs but does not mention available patches or fixes. The activity reflects advancing Iranian ICS attack capabilities against critical infrastructure sectors such as energy, water, and government services.

The attacks allow adversaries to manipulate PLC logic, disable critical safety shutdowns and alarms, and falsify data on operator interfaces, potentially causing unsafe operational conditions without operator awareness. This compromises the integrity and availability of industrial control processes in critical infrastructure sectors. The advisory does not report confirmed successful disruptions but indicates significant risk to operational safety and reliability. No known exploits in the wild are confirmed beyond the advisory's findings.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The advisory includes updated detection guidance and indicators of compromise for identifying malicious activity. Organizations should monitor for unauthorized project file changes and connections to PLCs via vendor programming software. Since no official fixes or patches are stated, applying vendor security updates when available and restricting network exposure of PLCs and programming interfaces is recommended. Follow the advisory's specific detection and response recommendations.