Iran-Linked Hackers Disrupt U.S. Critical Infrastructure

Executive Summary

MITRE ATT&CK for ICS

By the Numbers

What Happened

On April 7, 2026, CISA published advisory AA26-097A, co-signed by CISA, FBI, NSA, EPA, DOE, and U.S. Cyber Command. The advisory states that "since at least March 2026," Iranian-affiliated actors have disrupted programmable logic controllers across U.S. critical infrastructure — specifically targeting water treatment, energy, and government facilities.

The targeted devices are Rockwell Automation CompactLogix and Micro850 PLCs — the same vendor whose equipment runs a significant portion of U.S. industrial control systems. According to the advisory, attackers used Studio 5000 Logix Designer (Rockwell's legitimate engineering software) and deployed Dropbear SSH on compromised controllers for persistent access.

The advisory lists five targeted ports:

Every verifiable claim in the advisory was tested against primary sources. Some confirmed. Some did not.

The Evidence

Beyond the advisory itself — what the raw data from network sensors, certificate transparency logs, passive scanning databases, WHOIS records, and dark web intelligence actually shows.

CISA STIX IOCs — The Attacker IPs

The advisory's STIX IOC file (initially returning HTTP 403) contains 8 IP addresses attributed to the attackers.

Background — The Playbook They Used Before

The same group ran a confirmed campaign in November 2023 targeting Israeli-made Unitronics PLCs. That operation is relevant because it establishes the pattern now repeating at scale against American-made Rockwell systems.

ICS Port Scanning Telemetry — 2026 Campaign Window

Global sensor network data for the critical Rockwell port (44818/EtherNet-IP) shows a clear inflection in March-April 2026, reversing a months-long decline.

Port 44818 (Rockwell EtherNet/IP):

Port 2222 (advisory-listed PLC port):

A significant anomaly appeared days before the U.S. strikes on Iran:

Port 20256 (Unitronics) — Target Shift Confirmed: Flat at ~2,700/day through February–April 2026. No increase. The focus has moved from Israeli-made to American-made PLCs.

Kupferle Water Solutions — The First Named 2026 Target

CISA named zero victims. Dark web monitoring captured something the advisory did not disclose.

On March 20, 2026, a Telegram post by "APT IRAN" included a screenshot showing access to a Kupferle 9800i-120-A-X-A water treatment controller. The screenshot reveals:

• Device date/time: 03/10/26 09:48:41 (March 10, 2026)
• Free Chlorine: 0000.00 PPM
• Temperature: 67.89 F
• Status: "Flushing in Progress"
• BV and SV values showing X (error/offline state)
• Persian text claiming access in Fenton, Missouri
• Claims of value manipulation and persistent access

Kupferle is a real company — a water infrastructure equipment manufacturer based in St. Louis, Missouri, founded in 1897. They manufacture water main flushing systems, hydrants, and related equipment used by municipalities across the United States.

The Attack Nobody Is Reporting — Rockwell's Supply Chain

The most significant finding is not about PLCs. It is about Rockwell Automation's own corporate systems.

Dark web stealer log databases show 27 unique Rockwell Automation employees with credentials stolen by info-stealing malware and available on dark web markets, concentrated in March-April 2026.

Malware found on employee machines:

23 unique IPs from compromised machines span Mexico, Taiwan, Japan, UK, Colombia, India, South Africa, and other countries — suggesting infections across Rockwell's global workforce.

Not SCADA — The Real Attack Surface

A critical misconception in public reporting: nearly every news outlet describes these as "SCADA attacks." They are not.

The primary targets are PLCs (Layer 1 controllers), not SCADA systems (Layer 2 supervisory). Attackers connect directly to PLCs via EtherNet/IP or PCOM protocols, bypassing SCADA entirely. SCADA displays are affected as a secondary consequence — they show whatever the compromised PLC tells them.

The 5 actual attack surfaces in this campaign:

1. Internet-exposed PLCs — directly accessible via EtherNet/IP (port 44818)
2. Default credentials — Unitronics Vision "1111", Rockwell factory defaults
3. Legitimate engineering software — Studio 5000 used from leased infrastructure to create accepted PLC connections
4. SSH persistence — Dropbear SSH deployed on compromised controllers (port 22)
5. Supply chain — Rockwell employee credentials providing potential access to deployment data and firmware systems

Operational Impact

Across every confirmed incident, these actors have demonstrated the ability to reach and manipulate systems that control physical processes.

The Broader Threat Landscape

CyberAv3ngers is not operating in isolation. Dark web monitoring captured 50+ SCADA/water infrastructure attack claims in just three months (February–April 2026) across multiple groups:

ICS/SCADA targeting is not an Iranian monopoly — it is a global trend with multiple state and non-state actors converging on the same attack surface: internet-exposed industrial controllers with weak or default credentials. The Stryker attack (Handala/MOIS) is a completely different organization from CyberAv3ngers (IRGC-CEC) — different sponsor, different methods, different targets.

2026 Campaign Timeline

Chronology of the current campaign, reconstructed from dark web intelligence, ICS port telemetry, and government disclosures.

MITRE ATT&CK for ICS — Full Mapping

Indicators of Compromise

CISA-Listed Attacker IPs (from STIX file)

IOCONTROL Malware (Prior Campaign — 2023/2024)

From the same threat group's earlier operations. The 2023 C2 infrastructure is now seized/dead. No malware sample has been disclosed for the 2026 Rockwell campaign.

Targeted Ports

Targeted Devices

Where Continuous Monitoring Makes the Difference

Data Sources