When the Network Lets Them In: What the Latest Iran-Linked PLC Attacks Tell Us About OT Defense

When the Network Lets Them In: What the Latest Iran-Linked PLC Attacks Tell Us About OT Defense

Last week (April 8, 2026) the FBI and CISA issued a joint advisory, stating that Iranian cyber actors are actively targeting internet-exposed PLCs across U.S. critical infrastructure. The sectors hit include water and wastewater systems, energy, and government facilities. The specific devices called out are Rockwell Automation Allen-Bradley CompactLogix and Micro850 PLCs, equipment that shows up in industrial environments across the country.

The advisory is worth reading in full. What stands out, though, isn’t the headline. It’s the details of how the attacks actually worked.

They didn’t need an exploit

The threat actors used leased, third-party infrastructure, and deployed Dropbear SSH to gain remote access to their victim’s PLCs. The PLCs in question were Rockwell Automation which use Studio 5000 Logix programming software, the same tool a legitimate engineer would use on any given day. Once connected, they pulled the device’s project file, and manipulated the data being displayed on HMI and SCADA screens.

According to the FBI, the attacks resulted in diminished PLC functionality, manipulation of display data, and in some cases real operational disruption and financial loss.

It is also worth asking why these PLCs were reachable in the first place. In most industrial environments, access control and authentication on PLCs are either absent or simply not enforced. Native security features, where they exist, are often not implemented. That is not a criticism of any one vendor. It is the reality of how OT environments have been built and are operated.

This is the scenario that makes OT security genuinely hard. Not a dramatic zero day, but a quiet, authorized-looking connection that uses your own tools against you. The network saw nothing wrong. Because, technically, nothing was wrong.

Where perimeter security runs out of road

Most OT security programs are built around network segmentation, firewalls, and monitoring the traffic moving between IT and OT zones. Those controls have real value. But this attack shows exactly where they stop being useful.

When an attacker establishes a connection that looks legitimate to the network (correct protocol, correct credentials, correct software), the network has no reason to flag it. The threat is already inside. What’s left exposed is the device itself: its logic, its configuration, what it reports to the people responsible for running the facility.

What the advisory is actually pointing to

The CISA and FBI mitigation list is worth looking at closely, because it tells you something important about where the real gap is.

The agencies recommend preventing remote modification of PLC logic entirely, and monitoring for unusual activity at the device level, not just at the network boundary. They recommend implementing strict user authorization and authentication, as well as multi-factor authentication. They recommend treating each PLC as an independent security boundary, hardened and maintained on its own terms, not just protected by whatever sits in front of it. 

Read together, these recommendations describe a security posture that lives on the device-level, not upstream of it. The underlying assumption is that a connection can look legitimate and still be an attack. Which means the point of enforcement has to be somewhere the attacker cannot replicate: the device itself.

What this means in practice

If your current OT security strategy relies primarily on network monitoring and segmentation, this advisory is worth sitting with. The specific question to ask is what happens after a trusted connection gets established. At that point the perimeter has already failed, and the device is completely exposed. The answer is not just better network controls. It is adding a layer of defense that lives at the device level itself. The advisory points directly to this: privileged access management with multi-factor authentication, strict user authorization, and controls that enforce what can and cannot be done regardless of how a connection was initiated.

The attack pattern documented here is not new. Iranian actors have used similar approaches against Israeli PLCs, U.S. water utilities, and energy infrastructure going back years. What is changing is the pace. As Check Point’s Sergey Shykevich noted in response to the advisory, this is not a new threat. It is an accelerating one.

The right response is not to overhaul everything overnight. It is to be honest about where your current defenses assume the perimeter held, and what you are relying on when it does not.

Full advisory available via CISA. Original reporting by Ravie Lakshmanan at The Hacker News.

To learn more about how the OTOPIQ platform protects devices directly with PAM and MFA, visit our product page.