On April 7, 2026, the FBI, CISA, NSA, EPA, Department of Energy, and US Cyber Command issued joint advisory AA26-097A, confirming that Iranian-affiliated APT actors had been disrupting the function of Rockwell Automation and Allen-Bradley programmable logic controllers across multiple US critical infrastructure sectors since at least March. Targeted equipment included the CompactLogix and Micro850 controller families. The agencies attributed the activity to actors aligned with the IRGC Cyber Electronic Command and tracked under the personas CyberAv3ngers, Shahid Kaveh Group, Storm-0784, and UNC5691. Some victims, the advisory said, experienced operational disruption and financial loss. The campaign is documented as an active operation in the 2026 multi-sector PLC campaign incident record.
The technique is striking in its restraint. Operators leased VPS infrastructure, installed Rockwell’s own legitimate engineering software (Studio 5000 Logix Designer and FactoryTalk), and connected to internet-facing PLCs over EtherNet/IP on port 44818, then modified project files and manipulated data displayed on HMI and SCADA screens. No zero-day was used. The agencies also flagged secondary indicators on Siemens S7 PLCs and noted Dropbear SSH for persistence on supporting infrastructure. CVE-2021-22681, the Rockwell authentication-bypass first patched five years ago, was added to CISA’s Known Exploited Vulnerabilities catalog in early March 2026 as a precursor to the joint disclosure.
Censys published independent scanning data within two days of the advisory. Its researchers identified 5,219 internet-exposed hosts globally responding to EtherNet/IP and self-identifying as Rockwell or Allen-Bradley devices. The United States accounts for 74.6 percent of that exposure (3,891 hosts), with notable secondary exposure in Spain, Taiwan, and Italy. Censys also catalogued co-exposed services on the same hosts, including 771 instances of VNC providing direct remote-desktop access to operator workstations.
Palo Alto Networks Unit 42 updated its Iran threat brief on April 17 to reclassify the activity under cluster CL-STA-1128 and to capture a sharp post-advisory shift in scanning telemetry. Unit 42 reported that traffic from Iranian IP space rose to roughly 300,000 services per day after April 8, up from a baseline of approximately 20,000 in late February. The cluster’s pivot from Unitronics targeting (the 2023 Aliquippa pattern) to Rockwell platforms reflects a deliberate scaling decision: Rockwell’s installed base across US water utilities is an order of magnitude larger.
On May 15, 2026, CNN reported a parallel strand of the same campaign. US officials disclosed that hackers had breached internet-exposed, password-less automatic tank gauge (ATG) systems at gas stations across multiple US states, tampering with the fuel-level readings shown on tank displays without altering the physical fuel volumes. Officials named Iran as the leading suspect — citing its documented history of targeting fuel-tank systems — while cautioning that sparse forensic evidence may prevent definitive attribution. The episode is logged as a separate gas-station ATG breach incident record; it widens the campaign’s recorded scope from engineering-grade PLCs to the much softer target of unauthenticated retail-fuel telemetry, where the dominant risk is an undetected leak rather than supply disruption.
Among confirmed 2026 victims, no organisation has been publicly named in the advisory itself, though the Minot, North Dakota water plant ransomware incident two weeks earlier and the broader Sandworm-attributed Muleshoe, Texas tank-overflow event from January 2024 are the closest documented analogues for the operational-disruption mode the agencies described. The defender takeaway is narrow and hard. Internet-exposed engineering ports are the campaign; project-file integrity monitoring, EtherNet/IP egress controls, and removal of Studio 5000 from any internet-reachable jump host are the controls.