Geopolitical insight, threat intelligence, and practical guidance for the moments when world events become cyber risk.

1. Geopolitical context

On February 28, 2026, the coalition formed by the United States and Israel launched the codenamed Operation Epic Fury (U.S.) and Operation Roaring Lion (Israel) against Iran. The conflict is having global repercussions, both military and economic, as well as commercial ones (see, in this regard, the blockade of the Strait of Hormuz).

The other aspect that interests us and concerns us closely is cyberspace. In the immediate aftermath, Iran’s domestic internet connectivity dropped to between 1% and 4% of normal capacity and remained at near-blackout levels for 47 consecutive days. As of 17 April 2026, Iran began restoring limited access for selected segments of its population through the National Information Network.

But the cyber operations didn’t stop. According to Hackmanac, 1,245 cyberattacks have been recorded since February 28, involving 99 different threat actors and 14 countries. There were 17,770 cyberattacks in 2025, a 113% increase from the previous year.

This trend is set to grow, in part and above all, due to the current geopolitical situation and existing tensions and conflicts around the world. This confirms that cyberattacks are becoming a constant feature of geopolitics. And Iran is no exception.

On March 11, 2026, nearly two weeks after hostilities began, Iranian Hacktivist group Handala launched a “living-off-the-land” attack on one of the world’s leading medical device companies, Stryker, using the legitimate Microsoft Intune tool. They did so in response to the bombing of the Iranian school in Minab, which killed 160 girls.

Cyberspace is becoming another front in the war, with attacks growing increasingly sophisticated and destructive. At WatchGuard, we monitor and assess the global cyber landscape to provide proactive responses to existing threats.

2. The Threat and Its Targets

Since at least March 2026, the Iran-affiliated Advanced Persistent Threat (APT) group tracked as CyberAv3ngers has been actively compromising internet-exposed Programmable Logic Controllers (PLCs) deployed across U.S. critical infrastructure. A PLC is an industrial control system designed to automate processes, machines, or production lines. It operates continuously: it receives input signals (such as from sensors), processes the information using a preloaded program, and, based on the defined logic, activates the necessary outputs (such as motors, valves, or actuators). PLCs enable the automation of everything from simple tasks to complex industrial systems, improving efficiency, reducing human error, and optimizing maintenance.

On 7 April 2026, a joint advisory (CISA Alert AA26-097A) co-signed by CISA, FBI, NSA, EPA, the Department of Energy, and U.S. Cyber Command confirmed that the threat actor has caused operational disruption and financial loss in the following sectors:

Targeted sectors

• Water and Wastewater Systems (WWS), including local municipal utilities
• Energy sector entities, with implications under NERC CIP for Bulk Electric System operators
• Government Services and Facilities, including local and municipal governments
• Indications of probing of additional manufacturing and OT-dependent sectors via port targeting

The criticality of a Programmable Logic Controller (PLC) attack

When we think about cyberattacks, we tend to think of attacks designed to steal data from a database, to hijack and encrypt sensitive information in order to demand a ransom (ransomware), or to flood a system with millions of requests to make it stop working (DDoS). In the case of an attack on a PLC, the situation is different.

As a PLC is a small device that tells a physical machine what to do (such as when a pump should turn on, when a valve should close, when a conveyor belt should stop), attacking a PLC is not like attacking a laptop. It does not steal data: it changes how the real world behaves. For a company, this can mean production lines that stop, products that come out faulty, machines that damage themselves, or, in the worst case, people getting hurt.

To understand what a PLC is, imagine one of those large cylindrical tanks that hold thousands of liters of water and supply tap water to thousands of homes in a municipality. The tank must always maintain a minimum level of water to ensure distribution, but it must never exceed a certain threshold, otherwise it would overflow. A level sensor inside the tank measures the amount of water present and sends this information directly to the PLC, which, if there is little water in the tank, turns on the pump that refills the tank from the main supply, but turns it off when the maximum level is reached. This decision is made automatically, dozens of times a day, without anyone intervening.

Just consider what happened in Aliquippa, Pennsylvania, in November 2023, when attackers took control of a PLC and shut down a pump on a supply line that carries drinking water from the Aliquippa Municipal Water Authority’s treatment plant to the towns of Raccoon and Potter in Beaver County. The incident was quickly resolved and did not have devastating consequences, but it should make us reflect on how, in the digital age, the battlefield has expanded to encompass the fabric of everyday life.

The attack was carried out by the very group analyzed in this report: CyberAv3ngers.

Geographic Exposure

According to Censys research (April 2026), there are 5,219 internet-exposed hosts globally that respond to EtherNet/IP (port 44818) and self-identify as Rockwell Automation/Allen-Bradley devices. The vast majority are located in the United States (74.6%). But they are also present in Spain (110), Taiwan (78), and Italy (73).

Targeted devices

The advisory specifically identifies the following as confirmed targets:

• Rockwell Automation Allen-Bradley CompactLogix
• Micro850 PLCs
• MicroLogix 1400 PLCs running firmware versions C/21.02 and C/21.07

Indicator analysis suggests possible targeting of Siemens-manufactured devices and other OT vendors as well.

The actor’s port selection (see Section 4.1) is broad enough to support multi-vendor reconnaissance and exploitation.

The activity targets Rockwell Automation/Allen-Bradley PLCs reachable from the public internet, with strong indications that other vendors’ devices are being probed. The current campaign represents a deliberate shift to Rockwell Automation/Allen-Bradley PLCs (notably the CompactLogix and Micro850 product families).

The activity uses internet-exposed devices, leased third-party hosting infrastructure, and the legitimate Studio 5000 Logix Designer engineering software to establish accepted connections to victim PLCs. Observed impacts include manipulation of HMI/SCADA displays and disruption of industrial automation processes.

Confirmed impact has been observed.

Victims have reported operational disruption, manipulation of HMI/SCADA displays, and financial losses, indicating the campaign has moved beyond reconnaissance into disruptive intent.

A significant share of exposed devices are MicroLogix 1400 PLCs running firmware versions C/21.02 and C/21.07, both at end-of-sale. These devices have limited ongoing security support and expose firmware version strings unauthenticated in every Ethernet/IP identity response, allowing actors to enumerate and prioritize unpatched targets at scan time.

Co-exposed services. Censys observed 771 instances of VNC and 280 of Telnet co-located with EtherNet/IP exposure across the same population. VNC in particular maps directly to the HMI/SCADA manipulation vector described by CISA.

Bottom line for our customers

Any organization with internet-exposed Operational Technology (OT) — particularly Rockwell/Allen-Bradley CompactLogix or Micro850 PLCs, or devices using OT ports 44818, 502, 102, 22 or 2222, should treat itself as in-scope for targeting and assess exposure as a matter of priority.

Mitigation guidance is provided in Section 5.

3. Campaign Analysis – CISA Advisory AA26-097A

3.1 Campaign at a glance

On 7 April 2026, CISA, FBI, NSA, EPA, the Department of Energy and U.S. Cyber Command issued joint advisory AA26-097A documenting an active Iranian-affiliated APT campaign targeting internet-exposed PLCs. The advisory consolidates findings from victim engagements conducted since at least March 2026 and confirms operational disruption and financial loss across multiple critical infrastructure sectors.

3.2 Tactics, Techniques and Procedures (MITRE ATT&CK for ICS and Enterprise)

The table below maps observed CyberAv3ngers behaviour to MITRE ATT&CK:

3.3 Tools and infrastructure

• Rockwell Studio 5000 Logix Designer
  Legitimate engineering software abused to establish accepted connections to victim PLCs. Detection requires monitoring for unexpected engineering-tool connections, not signature-based malware controls.
• Leased third-party hosted infrastructure
  Overseas-based VPS providers used to mask operator origin. Source IPs are non-residential and concentrated in jurisdictions outside normal customer business operations.
• FactoryTalk software (per Unit 42 reporting)
  Unit 42 assesses with moderate confidence that operators have installed FactoryTalk on VPS infrastructure to support exploitation of Rockwell devices, indicating supply-chain knowledge of the targeted environments.

4. Indicators of Compromise

Important: The IOCs below should be vetted against your operating environment before any blocking action. Several IPs are commercial VPS ranges and may host legitimate services. Recommended use is detection and alerting first; blocking only after contextual validation.

4.1 Network indicators – OT ports under active targeting

4.2 Network indicators – Iran-conflict related infrastructure

The following infrastructure has been observed by Unit 42 (Palo Alto Networks) supporting the broader Iran-aligned threat ecosystem during the same reporting period. While not all directly tied to CyberAv3ngers, they represent a coherent threat picture and should be considered for blocklist inclusion in environments where business need is absent.

StealC infostealer infrastructure (sample)

• hyperfilevault1[.]xyz
• hyperfilevault2[.]mom
• hyperfilevault3[.]mom
• hyperfilevault3[.]pics
• megafilehost2[.]sbs
• filehost36[.]sbs
• filehost37[.]sbs
• megadatahost3[.]homes
• maxdatahost1[.]cyou

Conflict-themed phishing / fraud domains (sample)

• iran2026[.]org
• iranpaye[.]com
• forever-iran[.]net
• irandonation[.]org
• irancross[.]shop
• trumpvsirancoin[.]xyz
• aramcoamericainvest[.]com

Malicious mobile / wiper delivery

• hxxps://www[.]shirideitch[.]com/wp-content/uploads/2022/06/RedAlert[.]apk
  Trojanised Israeli emergency-alert app delivering surveillance malware
• hxxps://api[.]ra-backup[.]com/analytics/submit.php
  Associated C2 endpoint

IPs

The attackers used foreign IP addresses to access Rockwell Automation/Allen-Bradley PLCs exposed to the internet, exploiting legitimate configuration software such as Studio 5000 Logix Designer to establish authorized connections to the target devices, including CompactLogix and Micro850:

• 185.82.73.160–.171
• 135.136.1.133

5. Mitigation Recommendations

Recommendations are tiered by urgency. Sections 5.1 and 5.2 address the immediate exposure created by the AA26-097A campaign; Section 5.3 addresses the structural posture that makes such campaigns viable in the first place.

5.1 Immediate (within 72 hours)

• Identify all internet-facing OT devices. Conduct an external attack-surface review focused on Rockwell Allen-Bradley CompactLogix and Micro850 PLCs, and any device exposing ports 44818, 502, 102, 22 or 2222 to the public internet.
• Disconnect or firewall off internet-exposed PLCs. Per Rockwell Automation guidance SD1771 and CISA recommendations, control systems should not be directly reachable from the public internet under any circumstances.
• Review authentication on PLCs. Confirm that all devices use unique, strong passwords. Address Rockwell PN1550 / CVE-2021-22681 if not already remediated. CVE-2021-22681 is a vulnerability allowing attackers to bypass authentication on certain Rockwell PLCs
• Hunt for the IOCs in Section 4. Search at least 90 days of network and DNS logs for matches against the listed indicators, with particular attention to the OT ports listed in 4.1.
• Place physical mode switches in RUN position. For CompactLogix and MicroLogix devices with a hardware mode switch, this is the single most effective control identified by Rockwell Automation against the AA26-097A campaign — it is the only control surface that the CIP protocol cannot remotely override. This is a physical, in-person action; it cannot be automated.

5.2 Short term (1–2 weeks)

• Deploy or harden network segmentation between IT and OT environments, with explicit deny-by-default policy on OT-bound traffic.
• Implement geographic IP filtering on OT-adjacent management interfaces where business need does not justify global access.
• Validate offline backups of PLC configurations and SCADA project files. Iranian threat actors have a documented history of wiper attacks; backup integrity is the primary recovery control.

5.3 Strategic (>30 days)

• Adopt the CISA Cross-Sector Cybersecurity Performance Goals (CPGs 2.0) as the baseline for OT cybersecurity governance.
• Test the security programme against MITRE ATT&CK for ICS, with adversary emulation focused on the TTPs in Section 3.2.
• Review the incident-response plan for OT-specific scenarios, including the loss of HMI/SCADA visibility and the need for safe-state operating procedures.
• Brief executive leadership on geopolitical-cyber linkage as an ongoing risk factor, not a one-off event tied to a specific conflict.
• For NERC CIP-regulated entities: confirm alignment between CISA recommendations and CIP-005 (Electronic Security Perimeters), CIP-007 (System Security Management), and CIP-010 (Configuration Change Management) controls.

6. Sources and References

6.1 Primary Government Advisories

• CISA, FBI, NSA, EPA, DOE, and USCYBERCOM Joint Cybersecurity Advisory AA26-097A: “Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across U.S. Critical Infrastructure”, 7 April 2026
• Cyber Law: Cyber Incident Against a Water Authority in Pennsylvania, 2023
• CISA Iran Threat Overview and Advisories
• Hackmanac
• Rockwell Automation PSIRT advisories PN1550, CVE-2021-22681, and SD1771, 2026 customer guidance on PLC hardening
• Censys ARC Research: “Iranian-Affiliated APT Targeting of Rockwell/Allen-Bradley PLCs: Internet Exposure Assessment in Response to CISA Advisory AA26-097A”
• Picus Security: “CISA Alert AA26-097A: Iranian-Affiliated Actors Target PLCs Across U.S. Critical Infrastructure”

6.2 Commercial Threat Intelligence

• Unit 42, Palo Alto Networks: Threat Brief, “March 2026 Escalation of Cyber Risk Related to Iran,” updated 26 March 2026
• Unit 42, Palo Alto Networks: Tracking of cluster CL-STA-1128 / CyberAv3ngers / Storm-0784 activity against Rockwell Automation devices, March 2026
• SecurityWeek: “Iran-Linked Hackers Disrupt U.S. Critical Infrastructure via PLC Attacks”

6.3 Frameworks and reference data

• MITRE ATT&CK for ICS – Techniques T0828, T0832, T0841, T0882, T0883, T0885, T0889. MITRE ATT&CK Enterprise – Techniques T1219, T1565.
• CISA Cross-Sector Cybersecurity Performance Goals 2.0 (CPGs 2.0)
• NERC Critical Infrastructure Protection (CIP) standards – CIP-005, CIP-007, CIP-010

6.4 Validation rule applied

In line with the SOP for this report series, every geopolitical-to-cyber linkage stated in this document is supported by at least one Tier 1 source (a government CSIRT, a major commercial CTI vendor, or a published joint advisory). No conjectural attribution is made beyond what these sources have already published.

Classification: TLP:CLEAR.Disclosure is not limited. Information is suitable for use in marketing communications, customer-facing publications and public-facing channels.

Prepared by: Threat Intelligence – SOC. Review: Paolo Omezzolli peer review and management sign-off.