Federal agencies say attackers are infiltrating internet-connected PLCs to manipulate displays, trigger outages, and disrupt operations.

Experts note a shift from attacking exposed ICS to deep-access operations, underscoring the need for proactive, up-to-date defenses.

The advisory initially identified attackers targeting Rockwell Automation controllers, but has expanded to include systems from Schneider Electric and Siemens as well.

U.S. cybersecurity authorities have expanded the target vendors to Siemens, Schneider Electric, and Rockwell Automation in Iranian-led attacks on industrial control systems and OT/ICS environments.

Iranian groups CyberAv3ngers and Handala are highlighted, with Handala making disruptive claims against Stryker and potential water utility disruption claims.

Past incidents tied to the same actors include espionage and disruptive hacks, with allegations of data breaches and unverified disruption claims against water providers and medical technology firms.

This activity is part of a wider wave of Iranian cyber operations connected to regional conflict involving Iran, the U.S., and Israel.

The warning emphasizes the risk to essential services and potential outages in water treatment and energy supply from manipulation of control systems.

The advisory provides new guidance for detecting malicious activity and updates indicators of compromise to aid defense.

Initial discoveries showed Rockwell Automation controllers being attacked, with the scope now broadening to Schneider Electric and Siemens products, widening the vulnerable ecosystem.

An official advisory notes hackers target internet-connected OT/ICS networks’ PLCs to alter operator displays, causing outages and operational disruptions.

The advisory signals an ongoing escalation of Iranian cyber activity against critical infrastructure amid broader geopolitical tensions.