Iran-Linked Hackers Expand From Rockwell to Siemens and Schneider, Blinding US Water and Energy Operators With Fake Data

The Screen Says Everything Is Fine

The story on July 22 arrived with a simple frame: Iranian hackers expanded their targeting of U.S. critical infrastructure from Rockwell Automation to also include Schneider Electric and Siemens. Seven federal agencies signed the advisory. The vendor list grew.

But the advisory from CISA, the FBI, the NSA, the Department of Energy, and three other federal agencies describes something more precise than a broader hit list. Attackers are manipulating data on the human-machine interface and SCADA displays that water and energy operators watch all day. The screens that report tank levels, pipe pressure, pump status, chemical concentrations. The hackers are feeding false readings to the people responsible for keeping water safe and electricity flowing. 1

In at least one documented case, the FBI found that attackers rewrote a controller's programming logic to disable the alarms and shutdown procedures that would normally warn operators of unsafe conditions. Systems could enter dangerous states with no one being notified. 2

This is a different category of attack. Ransomware locks you out and demands payment. Website defacement changes what you see, but the change is obvious. Data manipulation changes what you see and makes you trust it. A plant operator staring at a dashboard that reads normal while the physical process behind it drifts toward failure has no training protocol for the scenario. The safety model of every industrial control system rests on a single assumption: the instruments tell the truth. Remove that assumption and the whole framework for safe operation comes apart.

The July 22 update sharply escalates an initial advisory published on April 7. The original warning focused on Rockwell Automation and Allen-Bradley controllers. The updated version adds Schneider Electric and Siemens to the observed target list and warns that "potentially all internet exposed PLCs" may be at risk. 1

The advisory ties the campaign to Iranian-affiliated actors and notes previous similar activity by CyberAv3ngers, a group affiliated with Iran's IRGC Cyber Electronic Command. 1 The agencies assess the current activity is being conducted to cause disruptive effects within the United States. 1

The targeted sectors named in the advisory include water and wastewater systems, energy, and government services, including local municipalities. 1 In those environments, programmable logic controllers are the connective tissue. They open and close valves, regulate pressure, manage chemical dosing, and control power distribution. The advisory's central recommendation is blunt: remove PLCs from direct internet exposure. 1

The timing connects to a broader conflict. TechCrunch reports this campaign is part of a series of Iranian cyber operations that have intensified since the start of the war between Iran and the U.S. and Israel in February. 2 Earlier Iranian-linked attacks included the leak of FBI director Kash Patel's personal email and a destructive hack of medical technology company Stryker that wiped tens of thousands of employee devices. 2

Those operations followed familiar patterns of espionage, data theft, and device destruction. The PLC campaign is doing something different. It is not stealing information or breaking machines. It is occupying the space between the machine and the human who runs it, and corrupting the signal that passes through.

The advisory describes the consequences as "operational disruption and financial loss." 1 That measured phrase encompasses scenarios that turn dangerous quickly. A water utility that cannot trust its chlorine-level readings. A power station whose fault indicators have been silenced. A municipal system where the gap between what the screen shows and what is physically happening could be the gap between safe drinking water and a public health emergency.

For engineers building connected industrial systems, the advisory underscores that remote access to operational technology is a liability that must be engineered around with firewalls, secure gateways, and rigid segmentation between IT and operational networks. For operators on the ground, it means something more immediate: when the instruments are compromised, the only reliable sensor left is a person walking the plant floor with a clipboard and a manual gauge.

That is what a geopolitical conflict looks like when it reaches a water treatment plant in small-town America. Not a fire alarm or a lock screen. Just a dashboard that says everything is fine.