Internet-exposed PLCs are being actively targeted right now. If a PLC or HMI on your floor is reachable from the internet, assume it has been scanned. CISA‘s July 22, 2026 update to advisory AA26-097A confirms Iranian-affiliated actors are logging into exposed Rockwell, Siemens, and Schneider Electric controllers, stealing project files — and in one US case rewriting ladder logic to disable safety shutdowns.
What did CISA’s July 2026 advisory update actually say?
Advisory AA26-097A first published on April 7, 2026. On July 22, 2026, CISA — joined by the FBI, NSA, EPA, and DOE and partners — issued a significant update. The activity is attributed to Iranian-affiliated actors tied to the group known as CyberAv3ngers and Iran’s IRGC Cyber-Electronic Command.
The headline change is scope. The original advisory centered on Rockwell Automation / Allen-Bradley controllers. The July update expands the affected gear to add Schneider Electric and Siemens hardware. The technique is what makes this different from ordinary port scanning: the actors run the vendors’ own engineering software — Studio 5000 Logix Designer, TIA Portal, and EcoStruxure Control Expert — from leased third-party infrastructure, connect to internet-exposed PLCs, and exfiltrate the project files. At one US victim site they went further and modified the ladder logic to disable safety shutdown and alarm functions.
| Vendor | Example controllers named | Engineering software the attackers use | Commonly exposed port |
|---|---|---|---|
| Rockwell / Allen-Bradley | CompactLogix, Micro850 | Studio 5000 Logix Designer | 44818 (EtherNet/IP) |
| Siemens (newly added) | S7-1200 | TIA Portal | 102 (S7comm) |
| Schneider Electric (newly added) | Modicon M340 / BMX P34 | EcoStruxure Control Expert | 502 (Modbus) |
The pattern did not stay theoretical. In the days after the update, security vendor Tenable reported that coordinated attacks on July 26–27, 2026 disrupted more than 30 Minnesota water utilities — post-advisory corroboration of exactly the exposure the advisory describes.
You are not a water utility — so why do internet-exposed PLCs matter to your plant?
Here is the honest part: the named victims are water and wastewater, energy, and government — not manufacturers. On paper, this advisory is not about your machine shop or your packaging line. We are not going to pretend a small manufacturer is on an Iranian target list.
But the relevance is the gear, not the targeting. A CompactLogix, an S7-1200, a Modicon M340 — these are exactly the controllers sitting on ordinary small-business manufacturing floors, in building automation, food processing, and packaging. And internet scanning does not read your NAICS code. Automated scanners sweep the entire internet for a responsive port on 502, 102, or 44818 and try whatever answers, regardless of who owns it.
The exposure is large and measurable. Censys data reported by SecurityWeek counts roughly 48,000 internet-exposed ICS services in the US, including about 5,200 exposed Rockwell hosts globally. This is opportunistic exposure, not a campaign aimed at you specifically — but a controller reachable from the public internet is a controller anyone can find, and the same tools that hit a water plant work identically against your line.
How do PLCs and HMIs end up on the public internet?
Almost never on purpose. In the plants we assess, internet-exposed PLCs get there through a handful of predictable routes:
- Cellular modems from an integrator. A machine builder drops in a cellular router with a public IP so they can support the equipment remotely — and the PLC behind it is now on the internet, often without anyone in the office knowing.
- Port-forwards for vendor support. Someone opened a firewall port so a vendor could dial in for a commissioning task. The “temporary” rule outlived the project and became permanent.
- Flat networks. The PLC shares one subnet with office PCs and Wi-Fi. One exposed device, or one phished laptop, and the whole line is reachable.
- The “air gap” that is not one. Most floors are described as air-gapped and are not — the modem, the vendor laptop, or the forgotten port-forward quietly bridges it.
What makes this dangerous is that the industrial protocols on ports 44818, 102, and 502 were designed with no authentication. They assume a trusted network. Put one on the open internet and the controller will answer a stranger the same way it answers your engineer.
Why is stolen ladder logic a trade-secret problem, not just a safety one?
When the advisory says attackers exfiltrate project files, it is easy to read that as a technical footnote. It is not. A PLC project file is not just configuration — it encodes how your process actually runs: the sequences, timings, recipes, tolerances, and interlocks your team refined over years. That is process know-how, and it is a trade secret in the same way a formula or a tooling design is.
Stealing it does two kinds of harm. First, your competitive process walks out the door in a single file. Second, and more chilling, the file is the attacker’s rehearsal copy. It tells them precisely which rung controls the safety shutdown — which is how the actors at that US site could modify ladder logic to switch off protective functions on purpose. This is the operational-technology half of the same problem your engineering team already worries about with drawings; if you protect design files, control logic belongs on that list too. See our guide to protecting CAD files and engineering IP.
The 6-step plant-floor exposure audit
You do not need to boil the ocean. This is the sequence we walk a manufacturer through to find and close internet-exposed PLCs. Do them in order — discovery first, because you cannot protect what you have not found. Once a controller is closed off, keeping it current is its own discipline — our guide on which OT patches actually matter shows how to triage the flood of ICS advisories.
1. Discover what is actually exposed
Inventory every device that can reach the internet. Look up your public IP addresses in Shodan and Censys to see what the outside world already sees. Hunt specifically for cellular modems and firewall port-forwards installed by machine vendors. A clean scan is a start, not proof — absence from one index does not mean you are invisible.
2. Remove direct exposure
No PLC or HMI should have an inbound path from the internet. Delete the port-forwards. Put a properly configured firewall in front of the control network so nothing on ports 502, 102, or 44818 is reachable from outside.
3. Rebuild vendor remote access the right way
Your machine builders still need to get in — just not through an open port. Replace ad-hoc access with a VPN or ZTNA gateway, protected by multifactor authentication, using named, per-vendor accounts that are time-boxed to a session and fully logged. When the job ends, access ends.
4. Fix credential and firmware hygiene
Change default and shared passwords on controllers, HMIs, and the modems in front of them. Patch controller firmware on the vendor’s validated schedule — coordinated with the machine builder so you do not void a warranty or break a validated process.
5. Protect the project files
Keep offline, versioned backups of every PLC program and HMI project, run integrity checks so you can prove logic has not been altered, and handle those files with the same care as any other trade secret — restricted access, no casual copies on unmanaged laptops or USB drives.
6. Monitor and harden the boundary
Log and alert on access across the IT/OT boundary so an unexpected connection to a controller is something you see, not something you learn about later. Where the equipment allows it and your process permits, set the controller keyswitch to RUN so logic cannot be rewritten remotely.
What we secure — and what your machine vendor owns
This is where being clear about lanes matters, because getting it wrong wastes money and leaves gaps. QOS MSP secures the network path — the piece that decides whether a controller is reachable at all:
- The IT/OT boundary and the firewall conduits between office and floor.
- Secure remote access for vendors — VPN/ZTNA, MFA, time-boxed accounts.
- Exposure monitoring and alerting on boundary access.
What stays with your machine builder or system integrator is the controller itself: the PLC program and ladder logic, firmware updates validated against the machine, and anything done inside Studio 5000, TIA Portal, or EcoStruxure. QOS MSP does not program your PLCs, and we will not pretend to — that work is theirs, and it usually ties to the machine warranty. Our job is to make sure the wrong people cannot reach the controller in the first place.
Closing exposure is the urgent fix; the durable architectural fix is segmentation — properly zoning office IT away from the plant floor so a breach on one side cannot cross to the other. We cover that in depth in IT/OT network segmentation for manufacturers. And because an exposed controller is only one of the doors ransomware uses to stop a line, it is worth understanding how a ransomware attack shuts down production and what recovery actually takes.
Frequently asked questions
How do I find out if my PLCs are exposed to the internet?
Start by inventorying every device that can reach the internet, then look up your public IP addresses in the Shodan and Censys search engines to see what the outside world already sees. Pay special attention to cellular modems and firewall port-forwards that machine vendors installed for remote support. Roughly 48,000 internet-exposed ICS services are counted in the US, so this is common. Note that absence from a scan index is a starting point, not proof you are safe.
We need vendor remote access. How do we keep it without the exposure?
Replace open firewall ports with a VPN or ZTNA gateway protected by multifactor authentication. Give each vendor a named account rather than a shared login, grant access only for the length of a specific session, and log every connection. The goal is that a machine builder can still get in to support equipment, but no controller is ever directly reachable from the public internet and access ends when the job ends.
Are PLC project files really worth stealing?
Yes. A PLC project file encodes how your process actually runs, including the sequences, timings, recipes, tolerances, and interlocks your team developed over years. That is process intellectual property. It is also the attacker rehearsal copy, because the file shows precisely which rung of logic controls a safety shutdown, which is how attackers were able to disable protective functions at one US site.
Does our air gap protect us from this?
Usually not, because most networks described as air-gapped are not truly isolated. A cellular modem installed by a vendor, a laptop that moves between the office and the floor, or a single forgotten port-forward can quietly bridge the gap. Treat the air gap as a claim to verify with an actual inventory and an external scan, not as a control you can assume is working.
Who fixes this, our IT provider or the machine vendor?
Both, in separate lanes. Your IT provider or MSP owns the network exposure, the firewall, and secure remote access, which is what decides whether a controller can be reached at all. Your machine builder or system integrator owns the PLC program and firmware and any change made inside the vendor engineering software. Closing exposure and programming the controller are different jobs that should not be confused.
Where to start
Start with step one: find out what is actually exposed. Most manufacturers are surprised by what a discovery pass turns up — a modem nobody remembered, a port-forward from a project that ended two years ago. From there, closing exposure is methodical, not dramatic. QOS MSP has delivered managed IT since 2007, and we secure the network side of this: see our network security services and ongoing security administration.
Want to know whether your controllers are reachable from the internet? Talk to us — a short conversation and a discovery scan will tell you where you actually stand, before someone else finds out for you.
