Overview

On July 22, 2026, six U.S. federal agencies (the FBI, CISA, NSA, the EPA, the Department of Energy, and U.S. Cyber Command) jointly updated an advisory (AA26-097A) first issued in April 2026, warning that nation-state actors are still actively exploiting internet-facing programmable logic controllers (PLCs) across U.S. government facilities, water systems, and energy infrastructure.

What makes this campaign notable is not a new vulnerability. The attackers do not exploit a software bug at all; they scan the internet for exposed PLCs and human-machine interfaces (HMIs), then connect using the vendor's own legitimate engineering software with working credentials, indistinguishable at the network level from an authorized technician logging in to do maintenance. Once inside, they copy the controller's project file (the blueprint that encodes both control logic and I/O configuration), modify or delete pieces of that logic, including reusable code modules shared across many devices, and in some cases alter what operators see on their HMI/SCADA screens, so that unsafe conditions are not visually flagged. This activity has now caused real operational disruption and financial loss at some victim organizations, a meaningful escalation from a similar but largely disruption-free 2023 campaign.

The attacker infrastructure currently includes the domains ocferda[.]com and uuokhhfsdlk.tylarion867mino[.]com, and a cluster of IPs concentrated in the 185.82.73.0/24 range, traces to IOCONTROL, a custom Linux/MQTT-based malware platform that Claroty's Team82 first documented in December 2024 and attributed to CyberAv3ngers, a threat actor believed to operate under Iran's Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC).

Threat Actor Profile: CyberAv3ngers (IRGC-CEC)

Tracked aliases: CyberAv3ngers, Hydro Kitten, Shahid Kaveh Group, Storm-0784 Attribution: Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC), per CISA advisory AA23-335A and subsequent U.S. Treasury action Motivation: Geopolitical/state-directed: explicit targeting of Israeli-made industrial technology and U.S. critical infrastructure, framed by the group itself as retaliation tied to the Israel-Iran conflict Public posture: Unusually overt for a state-linked actor: CyberAv3ngers has repeatedly published Telegram posts bragging about specific compromises, including screenshots of victim management portals and scripts used to brick devices Sanctions/bounty: The U.S. Treasury sanctioned six IRGC-CEC officials linked to the group, and the Rewards for Justice program has offered a $10 million bounty for information leading to identification of anyone involved

CyberAv3ngers has a documented, multi-year track record against Western OT/IoT targets that directly precedes this 2026 activity:

• October-November 2023: The group compromised at least 75 Unitronics Vision series PLC/HMI devices at U.S. and Israeli water utilities, including the Municipal Water Authority of Aliquippa, Pennsylvania, the first confirmed cyberattack by an Iranian state actor against a U.S. water utility. Those devices were running default credentials; the fix was as simple as changing a password. The attacks defaced HMI screens with anti-Israel messaging, apparently intended as a show of access rather than to cause physical harm.
• Late October 2023-January 2024: CyberAv3ngers claimed on Telegram to have compromised roughly 200 Orpak Systems (Israel) and Gasboy (U.S.) fuel management systems, releasing screenshots of management portals and victim data. Claroty's Team82 later confirmed this activity was powered by IOCONTROL malware extracted from a compromised Gasboy OrPT payment terminal, a foothold that, per Claroty, would have given the attacker the ability to shut down fuel dispensing and potentially harvest customer payment card data.
• December 2023: An Israel-aligned hacktivist group, Gonjeshke Darande ("Predatory Sparrow"), claimed to have disrupted roughly 70% of Iran's gas stations in retaliation, illustrating how this activity sits inside a broader tit-for-tat cyber-physical conflict.
• 2026 (this campaign): The same TTP set (legitimate engineering software abuse rather than exploitation, HMI/display manipulation, project-file tampering) reappears at wider scale and with confirmed operational/financial impact, per the April and July 2026 CISA/FBI/EPA advisory updates. The agencies stop short of formally re-naming CyberAv3ngers in the 2026 advisory, but the tooling, targeting, and technique overlap with the group's established pattern is extensive.

Infrastructure

Attack Chain / Kill Chain

Stage 1 -- Reconnaissance: Internet-wide PLC/HMI scanning

The actors do not target specific organizations first; they scan the open internet for PLCs and HMIs reachable on known ICS ports. Public Shodan telemetry shows over 74,000 ICS devices currently directly reachable from the internet without honeypot filtering, down from roughly 120,000 for much of the period since 2017, but still a large exposed surface. Traffic tied to this campaign concentrated on five ports:

• 22/TCP (SSH)
• 102/TCP (ISO-TSAP, primarily Siemens STEP 7 / S7comm, also used by other protocols such as ICCP)
• 502/TCP (Modbus TCP)
• 2222/UDP (EtherNet/IP implicit messaging, time-critical I/O)
• 44818/TCP (EtherNet/IP explicit messaging, configuration/diagnostics, primarily Rockwell/Allen-Bradley, also used by other vendors such as Wago)

Stage 2 -- Initial Access: Legitimate engineering software, working credentials

Rather than exploiting a CVE, the actors connect to the exposed device using the vendor's own engineering workstation software, Rockwell's Studio 5000 Logix Designer for Allen-Bradley CompactLogix/Micro850 controllers, with the July 2026 advisory update confirming Schneider Electric and Siemens equipment is now also in scope. From a network-monitoring perspective, this session is architecturally indistinguishable from a legitimate technician performing routine maintenance. This is why the advisory frames the exposure as an architectural weakness (insufficient network segmentation, missing authentication gating, absent remote-access hardening) rather than a patchable flaw; there is no patch for "the device was reachable and had valid credentials."

Stage 3 -- Collection: Project file extraction

Once connected, the actor extracts the device's project file: on Rockwell equipment, a binary .ACD file built in Studio 5000 that stores ladder logic, the tag database, I/O configuration, and overall program structure, not just individual control rules.

Stage 4 -- Defense Evasion / Impact: Logic tampering and reusable-module poisoning

The actors modify or delete logic within the project file, including Add-On Instructions (AOIs), reusable, shared blocks of logic that many organizations drop into multiple PLC programs across an operation. Because a single tampered AOI carries its changes into every process that reuses it, this converts what should be a trusted engineering library into a supply-chain-style propagation vector. This is precisely the risk the July 22, 2026 advisory update added new detection guidance for.

Stage 5 -- Impact: HMI/SCADA display manipulation

In parallel, the actors alter what is displayed on operator HMI/SCADA screens, so that unsafe conditions triggered by the tampered logic (for example, disabled shutdown or alarm logic) are not visually apparent to the humans monitoring the process. This is the mechanism behind the advisory's warning that "attackers manipulated operator displays so personnel couldn't visually detect anything was amiss on their screens." Unlike the 2023 Unitronics campaign, which visibly defaced HMI screens as a show of access, this 2026 activity is built to be invisible to the operator; a materially more dangerous posture given that it has already produced confirmed operational disruption and financial loss.

Stage 6 -- Command and Control: IOCONTROL over MQTT

Where IOCONTROL is deployed (documented against Orpak/Gasboy fuel systems and other IoT/OT platforms; the malware is modular and compiled per target vendor), the implant authenticates to an MQTT broker using a per-victim GUID as its client ID, publishes a hello message containing hostname, current user, device model, firmware version, timezone, and geolocation to a {GUID}/hello topic, then subscribes to {GUID}/push to receive one of five opcoded commands: resend hello, verify the binary is executable, run an arbitrary OS command, self-delete (including removing its own persistence artifacts), or scan an IP range on a given port. All of this rides over MQTT/TLS on port 8883, chosen specifically because it blends with legitimate low-bandwidth IoT telemetry traffic and is less commonly inspected than standard HTTP(S) C2 channels.

Stage 7 -- Persistence

IOCONTROL installs itself to /usr/bin/iocontrol and drops a boot-time init script at /etc/rc3.d/S93InitSystemd.sh that runs a simple watchdog loop, relaunching the malware every 5 seconds if it is not already running, a durable, low-complexity persistence mechanism appropriate for embedded Linux targets that may not have modern EDR coverage at all.

Timeline

Indicators of Compromise

Network: IP Addresses (CyberAv3ngers/IOCONTROL C2, per CISA AA26-097A and internal brief)

Network: Domains

File Hashes

Host Artifacts

MITRE ATT&CK Mapping

Key Takeaways

This is not a patchable vulnerability: it's an exposure problem. No CVE is involved. Every mitigation in the CISA advisory is about removing PLCs from direct internet reach, gating remote access behind MFA, and validating that segmentation is actually enforced rather than assumed. Point-in-time vulnerability scanning will not catch this; continuous validation of what's internet-reachable is the only durable control.

The attackers are actively hiding the impact from operators. The shift from the 2023 Unitronics campaign (visible HMI defacement, a "show of access") to the 2026 campaign (silent logic tampering plus falsified HMI displays) reflects a deliberate escalation toward causing real, undetected physical-process impact rather than making a political statement. Confirmed operational disruption and financial loss are already attributed to this wave.

Reusable code libraries are now a supply-chain risk inside OT. The July 2026 advisory update's new guidance on tampered Add-On Instructions is the most forward-looking part of this story: a single poisoned, trusted logic module can propagate a compromise across every process and every PLC that reuses it, inside a single organization, without any additional attacker access.

Attribution matters less than the pattern. Whether or not this specific 2026 wave is formally re-attributed to CyberAv3ngers, the technique set (internet scanning, legitimate-software access, project-file tampering, HMI manipulation) is now a repeatable playbook other IRGC-aligned or opportunistic actors can and likely will reuse against any internet-exposed PLC, regardless of vendor.

References

1. CISA, FBI, NSA, EPA, DOE, U.S. Cyber Command. (2026, July 22, updated). AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a

2. CISA, FBI, NSA, EPA, DOE, U.S. Cyber Command. (2026, July). AA26-097A Advisory PDF. https://www.cisa.gov/sites/default/files/2026-07/aa26-097a-iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure_508c.pdf

3. FBI/IC3. (2026, July 22). Cyber Security Advisory 260722. https://www.ic3.gov/CSA/2026/260722.pdf

4. Bethea, J. (2026, July 23). Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure. Trend Micro / TrendAI Research. https://www.trendmicro.com/en_us/research/26/g/plc-exploitation.html

5. Team82. (2024, December 10). Inside a New OT/IoT Cyberweapon: IOCONTROL. Claroty. https://claroty.com/team82/research/inside-a-new-ot-iot-cyber-weapon-iocontrol

6. Team82. (2023). From Exploits to Forensics: Unraveling the Unitronics Attack. Claroty. https://claroty.com/team82/research/from-exploits-to-forensics-unraveling-the-unitronics-attack

7. CISA. (2023, December 1). AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities. https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a

8. Rewards for Justice. (2024, February). CyberAv3ngers Reward Offer. https://rewardsforjustice.net/rewards/cyberav3ngers/

9. Techtimes. (2026, July 23). Iranian Hackers Infiltrate Siemens and Schneider PLCs, Blinding Operators With Fake Readings. https://www.techtimes.com/articles/321335/20260723/iranian-hackers-infiltrate-siemens-schneider-plcs-blinding-operators-fake-readings.htm

10. Shodan. (2026). ICS Device Exposure Search (tag:ics -tag:honeypot). https://www.shodan.io/search?query=tag%3Aics+%21tag%3Ahoneypot