US agencies warn of attacks on industrial controllers

CISA and five partner agencies warned on 7 April of ongoing exploitation of internet-connected operational technology in US critical infrastructure. The official advisory announcement identifies Rockwell Automation and Allen-Bradley programmable logic controllers among the devices targeted by Iranian-affiliated cyber actors.

The affected sectors included government services and local municipalities, water and wastewater systems, and energy. The agencies described interference with controller project files and manipulation of information displayed in industrial monitoring systems. They said the activity had produced operational disruption and financial loss.

The warning concerns equipment that interacts with physical processes. It provides a different exposure picture from an attack limited to office email or employee documents.

The agencies recommended removing controllers from direct internet exposure, reviewing available logs for suspicious activity and following the detailed mitigation guidance. Operators who believed they had been targeted were directed to contact the agencies and Rockwell Automation. The announcement supplied no aggregate victim count or total financial-loss estimate.