CISA updated advisory AA26-097A on July 22, 2026 to formally expand the scope of confirmed Iranian-affiliated OT intrusions beyond Rockwell Automation hardware to include Schneider Electric and Siemens programmable logic controllers. The advisory, originally published in April 2026, now covers a broader set of PLC environments across US water and wastewater systems, energy infrastructure, and government facilities.
The threat actor behind these operations is CyberAv3ngers, assessed with high confidence to be affiliated with the IRGC Cyber Electronic Command (IRGC-CEC) and operating under the Shahid Kaveh Group. Industrial security firm Dragos tracks the same cluster as BAUXITE. Microsoft has attributed overlapping activity to Storm-0784; Mandiant tracks it as UNC5691.
What the Updated Advisory Adds
The July 22 revision confirms that intrusion activity previously documented against Rockwell Automation Allen-Bradley PLCs has now been observed against Schneider Electric Modicon and related product lines, as well as Siemens SIMATIC S7 series devices. The expanded scope reflects either an intentional shift in target selection to vendor-diversified environments or a recognition that the original advisory underreported the breadth of affected infrastructure.
The TTPs described in the original advisory apply across all three vendor environments. Actors are scanning for internet-exposed PLCs using standard industrial protocol ports — EtherNet/IP on 44818, Modbus on 502, Siemens ISO-TSAP on 102, and SSH on 22. Once access is established, operators use engineering workstation software to upload modified project files, disabling alarm and emergency shutdown logic before exfiltrating the original project files for intelligence collection.
For Rockwell environments specifically, CISA continues to flag CVE-2021-22681, which involves an insufficiently protected cryptographic key in Studio 5000 Logix Designer that allows project files to be manipulated or read without proper authentication. The advisory does not yet identify analogous CVEs for the Schneider Electric and Siemens expansion, suggesting those details remain under coordinated disclosure or active investigation.
Persistence is maintained via Dropbear SSH, a lightweight SSH daemon commonly used in embedded systems that is unlikely to trigger alerts in environments where SSH is expected on OT devices.
Operational Context
Water and wastewater systems remain the most confirmed sector for CyberAv3ngers activity. The advisory also names government services facilities and energy infrastructure as affected. The pattern is consistent with prior Iranian OT targeting, which has historically prioritised access and capability development in critical infrastructure rather than immediate destructive effect — though the advisory notes that disabling shutdown logic creates conditions where physical damage is possible if operational parameters are exceeded.
The July 22 revision is notable in that it was issued without a corresponding high-profile public incident, suggesting CISA is updating the advisory based on ongoing information sharing with sector partners and affected organisations rather than responding to a specific disclosed breach.
Recommended Actions
CISA’s recommended mitigations have not changed materially from the original advisory, but the expanded vendor scope means organisations running Schneider Electric or Siemens PLCs should now treat them as explicitly in scope for the same controls previously emphasised for Rockwell environments:
Remove PLCs from direct internet exposure. Industrial protocol ports should not be reachable from public IP space under any operational justification. Where remote access is required, segment it through a DMZ with strong authentication controls.
Audit PLC project files for unauthorised modifications. Focus on alarm configuration and emergency shutdown logic. Compare against known-good backups if available.
Inventory SSH access on OT devices. The presence of Dropbear SSH on a PLC where it was not intentionally configured is an indicator of compromise. Review any device running an unexpected SSH daemon.
Enable logging on engineering workstation connections. Studio 5000 Logix Designer connections and equivalent access via Siemens TIA Portal or Schneider Electric EcoStruxure should be logged and reviewed for anomalous upload events.
The CISA advisory includes specific YARA rules and network indicators tied to CyberAv3ngers infrastructure that can be used for retrospective detection across logs and packet captures.