Federal agencies updated their joint advisory on July 22, 2026, warning that Iranian-affiliated cyber actors are actively exploiting internet-connected programmable logic controllers across U.S. critical infrastructure. Trend Micro’s analysis of the update is blunt: this is not just a patch-management problem. In many cases, the attacker does not need a software vulnerability at all.

The core issue is exposure. PLCs, HMIs, and SCADA paths that should sit behind segmented operational technology networks are reachable enough for attackers to scan, connect with legitimate engineering tooling, and interact with project files as if they were authorized technicians. The updated advisory expands the concern beyond Rockwell Automation / Allen-Bradley to include observed targeting of Schneider Electric, Siemens, and potentially other PLC brands.

Original source: Trend Micro — Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure. Primary government advisory: CISA AA26-097A.

What changed in the July update

The most important change is that the campaign has moved from simple exposed-device abuse toward more operationally dangerous manipulation. The advisory describes malicious project-file interactions, changes to PLC logic, and manipulation of what operators see on HMI and SCADA displays. That means the attack can target both the physical process and the human decision loop watching that process.

CISA, FBI, NSA, EPA, DOE, Treasury, and U.S. Cyber Command say the activity has affected government facilities, water and wastewater systems, and energy organizations. Some victims experienced operational disruption and financial loss. That is the line that should get executive attention: this is not theoretical OT risk anymore.

Why this matters for SMBs and government contractors

Most small organizations do not think of themselves as critical infrastructure operators. But municipalities, utilities, manufacturers, facility-management firms, water districts, engineering integrators, and cleared or uncleared government contractors often sit near OT environments. The exposure may be a PLC, a cellular modem, an engineering workstation, a vendor VPN, a jump box, or an unmanaged remote-support path installed years ago and forgotten.

The uncomfortable part is that traditional vulnerability response will not solve this by itself. If the attacker uses valid credentials and legitimate engineering software over open OT ports, the traffic may look normal unless the organization has a known-good baseline for who should be touching controllers, from where, and during which maintenance windows.

Defensive priorities

  • Remove PLCs from direct internet exposure. Put OT access behind a secure gateway, firewall, or jump host with MFA and logging. Treat cellular modems as internet exposure unless proven otherwise.
  • Hunt for OT protocol traffic at the perimeter. Review logs for suspicious activity on ports 22, 102, 502, 2222, and 44818, especially from foreign hosting providers or unexpected remote-access networks.
  • Lock down engineering access. Limit who can use PLC programming software, require named accounts, and separate routine operator access from controller programming rights.
  • Baseline controller logic and project files. Maintain offline backups, compare current logic against known-good versions, and watch for unexpected changes in reusable code modules.
  • Use hardware and software protection modes. Where supported, keep physical mode switches in RUN and enforce vendor guidance for programming protection.
  • Test restore procedures before the incident. Backups only matter if the team can safely restore PLC logic and validate the physical process afterward.

Bulwark Black assessment

This advisory is a reminder that OT security is not just “patch the PLC.” The practical defense is architecture: remove direct exposure, control engineering access, log remote maintenance, and validate that segmentation actually blocks what leadership assumes it blocks.

For government contractors and public-sector-adjacent businesses, the immediate move is a focused OT exposure review. Inventory internet-facing assets, check firewall paths into industrial networks, confirm vendor remote-access methods, and document who can change controller logic. If those answers are unclear, the risk is already higher than it looks on paper.

The takeaway: Iranian-affiliated PLC exploitation is succeeding where operational convenience became permanent architecture. Fixing that does not require a massive procurement cycle. It starts with removing unsafe exposure and proving that only the right people can reach the systems that move the physical world.