Iran-linked CyberAv3ngers multi-sector PLC disruption campaign against US critical infrastructure

Beginning at least March 2026, Iranian-affiliated APT actors linked to the IRGC Cyber Electronic Command — tracked as CyberAv3ngers (aka Shahid Kaveh Group / Storm-0784) — conducted ongoing attacks against internet-exposed Rockwell Automation / Allen-Bradley PLCs deployed across US critical infrastructure. A joint advisory from FBI, CISA, NSA, EPA, DOE and US Cyber Command formally confirmed the campaign on April 7-8, 2026. Attackers used leased VPS infrastructure loaded with Rockwell Studio 5000 Logix Designer to connect to exposed devices (CompactLogix, Micro850), maliciously modify project files, and manipulate data shown on HMI / SCADA displays. The campaign followed US-Israel joint strikes on Iran in late February 2026 and is consistent with cyber-retaliation by Iranian state actors. Indicators also suggest targeting of Siemens S7 PLCs. Attack infrastructure used ports 44818, 2222, 102, 22 and 502; Dropbear SSH was deployed for persistence. Approximately 5,600 Rockwell / Allen-Bradley SCADA devices remained internet-exposed globally at the time of disclosure.

Multiple victims across water and wastewater, energy, and municipal government sectors confirmed operational disruption and financial loss. The advisory did not name affected organizations. An earlier related campaign by the same actor confirmed compromise of at least 75 PLC devices.