Iranian-Linked Hackers Target PLCs and PCM Boards

The FBI, CISA, NSA, EPA, DOE, and U.S. Cyber Command issued a joint advisory warning of Iranian-linked threat actors targeting PLCs, including Rockwell and Allen-Bradley control boards, across U.S. critical infrastructure networks.

These campaigns have focused on internet-facing PLCs and PCM boards in Government Services, Water and Wastewater Systems, and Energy sectors. The attackers are not only harvesting operational data — they are taking project files and manipulating what operators see on SCADA and HMI displays.

Why PLC and PCM exposure is dangerous

Programmable logic controllers (PLCs) and pulse code modulation (PCM) control boards are the automation backbone for pumps, valves, and distribution systems. When these devices are accessible from the internet, attackers can disrupt processes, corrupt telemetry, or alter human-machine interface outputs.

What the advisory says

The joint advisory says Iranian-affiliated actors have targeted internet-exposed operational technology devices and have already extracted project files. That means adversaries can reconstruct control logic and then feed false or manipulated data to control rooms.

Earlier warnings also connected this activity to campaign groups that have exploited industrial targets before, such as CyberAv3ngers and other Iran-linked operators. The advisory highlights a worrying trend: OT systems that remain internet-facing are increasingly attractive to nation-state-aligned actors.

Recommended defensive actions

• Disconnect PLCs and PCM boards from the public internet. Where possible, place them behind dedicated OT firewalls and jump hosts.
• Scan logs for known indicators of compromise. Review advisory feeds and OT logs for suspicious connections and unauthorized configuration changes.
• Apply firmware updates and harden OT equipment. Keep PLC, PCM, and HMI firmware current and disable unused ports, services, and default credentials.
• Enforce strong authentication. Use MFA for all OT network access and secure remote maintenance channels.
• Monitor OT-specific ports and behavior. Watch for unusual traffic on PLC/SCADA ports, unexpected project file transfers, and abnormal HMI state changes.

Practical OT resilience

Incident response in OT must assume that attackers can reach exposed PLCs. That means network segmentation, asset visibility, and continuous monitoring are not optional. The advisory is a call to action for teams responsible for Rockwell, Allen-Bradley, and other industrial control systems.

For security teams, the key takeaway is simple: treat internet-exposed PLC and PCM boards as high-risk assets, and move fast to isolate, audit, and harden them before the next targeted campaign succeeds.