<![CDATA[CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024.]]>CISA is claiming that is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. Has anyone seen recent evidence of this? None was provided from CISA, and we'd love independent confirmation.

]]>https://board.circlewithadot.net/topic/6bd41c3f-5db5-473e-a1d8-bcd0f4c69259/cisa-is-claiming-that-iran-is-once-again-targeting-programmable-logic-controllers-plcs-similar-to-efforts-in-2024.RSS for NodeThu, 30 Apr 2026 12:12:27 GMTMon, 13 Apr 2026 19:21:03 GMT60<![CDATA[Reply to CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. on Mon, 13 Apr 2026 20:48:03 GMT]]>For the record, we have received independent confirmation of this activity.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115741367687413652/statuses/116399360140502101https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115741367687413652/statuses/116399360140502101Mon, 13 Apr 2026 20:48:03 GMT<![CDATA[Reply to CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. on Mon, 13 Apr 2026 19:57:07 GMT]]>@ifin @nopatience I no longer work there, but USEPA may have corroborating information; as I understand it, the PLC targets are in drinking wand waste water systems; hence EPA’s potential involvement.

]]>https://board.circlewithadot.net/post/https://puget.social/ap/users/115709310722216374/statuses/116399159882958743https://board.circlewithadot.net/post/https://puget.social/ap/users/115709310722216374/statuses/116399159882958743Mon, 13 Apr 2026 19:57:07 GMT<![CDATA[Reply to CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. on Mon, 13 Apr 2026 19:32:10 GMT]]>@nopatience Thank you for these!

The first is a measurement of exposure of OT of types previously attacked, not a report of current exploitation. The second is a report about a new attack tool available for sale. These are useful, but neither are confirmation of CISA's claim that:

Iran-affiliated advanced persistent threat (APT) actors are conducting exploitation activity targeting internet-facing operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley.

Note the present tense, as of 2026-04-07.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115741367687413652/statuses/116399061784914089https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115741367687413652/statuses/116399061784914089Mon, 13 Apr 2026 19:32:10 GMT<![CDATA[Reply to CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. on Mon, 13 Apr 2026 19:29:19 GMT]]>@kiddcutty That's exactly the report we're trying to verify.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115741367687413652/statuses/116399050529828548https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/115741367687413652/statuses/116399050529828548Mon, 13 Apr 2026 19:29:19 GMT<![CDATA[Reply to CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. on Mon, 13 Apr 2026 19:28:01 GMT]]>@ifin There appears to have been some articles preceding the CISA advisory, and when viewed together may paint some sort of "capability" picture.

2026-01-28: https://lab52.io/blog/black-industry-irgc-linked-offensive-ot-framework/

2026-03-30: https://censys.com/blog/ics-iran-part-2-revisiting-exposure-of-previously-targeted-ics-devices/

And a few more. I have not spent a significant amount of time exploring these in depth, but just some quick references to potentially relevant articles.

]]>https://board.circlewithadot.net/post/https://swecyb.com/users/nopatience/statuses/116399045442501678https://board.circlewithadot.net/post/https://swecyb.com/users/nopatience/statuses/116399045442501678Mon, 13 Apr 2026 19:28:01 GMT<![CDATA[Reply to CISA is claiming that #Iran is once again targeting Programmable Logic Controllers (PLCs), similar to efforts in 2024. on Mon, 13 Apr 2026 19:23:38 GMT]]>@ifin

This was put out by CISA on April 7th. Attacks against Rockwell/Allen Bradley PLCs.

Access Denied

favicon

(www.cisa.gov)

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/kiddcutty/statuses/116399028179474335https://board.circlewithadot.net/post/https://infosec.exchange/users/kiddcutty/statuses/116399028179474335Mon, 13 Apr 2026 19:23:38 GMT