The U.S. federal government has significantly expanded its warning concerning cyberattacks on internet-facing Operational Technology (OT) by threat actors affiliated with the Iranian regime. First issued in April, the initial advisory focused on **Programmable Logic Controllers (PLCs)** from **Rockwell Automation** and **Allen-Bradley**. ### Broadening the Scope of Targeted OT On Wednesday, the **Cybersecurity and Infrastructure Security Agency (CISA)**, in conjunction with the **FBI** and the **Environmental Protection Agency (EPA)**, issued a revision that broadens the scope of targeted manufacturers. According to a CISA news release, the updated alert now “expands the manufacturer scope to include observed targeting of **Schneider Electric**, **Siemens** and possible other PLC manufacturers.” Both Schneider and Siemens PLCs are extensively deployed in critical infrastructure sectors across the U.S. and globally. ### Observed Attack Methods and Impact The observed incidents include “malicious project file interactions and manipulation of data on **Human Machine Interface (HMI)** and **Supervisory Control and Data Acquisition (SCADA)** displays.” These attacks have resulted in “operational disruption and financial loss” for targeted organizations. PLCs are fundamental components of critical infrastructure, underpinning operations in power utilities, wastewater treatment facilities, and manufacturing plants. ### Persistent Threat and Mitigation Recommendations Officials anticipate the pressure from Iran-affiliated attackers to persist. The advisory underscores the critical need for OT owners and operators to implement robust security measures, specifically advising them to “restrict direct internet access and ensure secure PLC deployment.” ### Attribution Challenges and Geopolitical Context While the federal advisory does not name specific cyber threat groups, attribution of Iranian government-affiliated attacks remains complex. Researchers note that the regime often employs ransomware gangs or other groups as a smokescreen to obscure its activities. For instance, a pro-Iranian hacktivist group that targeted a Los Angeles transit agency was later identified by researchers as an arm of the country’s intelligence services. This expanded warning comes amidst heightened geopolitical tensions. Former President Donald Trump recently issued a threat to target Iranian critical infrastructure, including bridges or power plants, should Tehran continue to target ships in the Strait of Hormuz.