On July 22, 2026, CISA, the FBI, and the EPA quietly updated one of the most alarming advisories of the year — and if your organisation runs a water treatment plant, energy grid, or manufacturing facility, the revision changes the threat calculus entirely. Iranian-affiliated hackers operating under the CyberAv3ngers banner have already infiltrated U.S. critical infrastructure, and CISA’s update confirms they have expanded their target list beyond Rockwell Automation to include Schneider Electric and Siemens programmable logic controllers (PLCs). Worse: the root vulnerability — CVE-2021-22681 — has no vendor patch. Defence-in-depth and zero-trust network segmentation are the only shield you have.

Key Takeaways

  • CISA expanded its April 2026 advisory on July 22, 2026 to cover Schneider Electric, Siemens, and “possibly other” PLC brands — not just Rockwell Automation.
  • The threat group CyberAv3ngers (IRGC-affiliated, also tracked as Hydro Kitten / Storm-0784 / UNC5691) is behind confirmed operational disruptions at U.S. water, energy, and government-services facilities.
  • CVE-2021-22681, the underlying authentication-bypass flaw in Rockwell’s Studio 5000 Logix Designer, was added to CISA’s Known Exploited Vulnerabilities catalogue in March 2026 and has no patch.
  • Attackers use legitimate OT engineering software — Studio 5000, EcoStruxure Control Expert, TIA Portal — to extract project files and falsify SCADA/HMI readings.
  • The fix is not a patch; it is network architecture: remove PLCs from direct internet exposure, enforce MFA, and apply zero-trust segmentation at the OT boundary.

Who Is CyberAv3ngers? Inside the IRGC’s Industrial-Sabotage Arm

CyberAv3ngers is not a garden-variety ransomware gang. The group is directly affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Command, specifically the Shahid Kaveh Group within the Electronic Warfare and Cyber Defence Organisation. Security researchers track the same cluster under multiple aliases — Hydro Kitten, Storm-0784 (Microsoft), UNC5691 (Mandiant) — and two additional ICS-specific sub-groups have now been identified: BAUXITE (ICS Kill Chain Stage 2 adversary) and PYROXENE (infrastructure operator).

The group first attracted global attention in November 2023 when it compromised at least 75 Unitronics PLCs at the Municipal Water Authority of Aliquippa, Pennsylvania (detailed analysis via The Hacker News). In 2024 the toolset upgraded with IOCONTROL, a custom ICS malware framework. By 2026 the campaign had matured into a sustained, multi-sector operation with confirmed financial losses and operational disruptions at victim organisations.

Operational cover is achieved through front personas — Homeland Justice, Karma/KarmaBelow80, and Handala Hack — which the CISA advisory describes as “interchangeable operational veneers.” The U.S. Treasury sanctioned six named IRGC officials in February 2024, and the State Department has placed a $10 million bounty on information about the group’s activities.

Technical Breakdown: How the Attack Chain Works

The attack methodology is deceptively simple — which makes it so dangerous. Every step leverages legitimate tools that defenders often whitelist.

Stage Technique Tool / Protocol
Reconnaissance Shodan/Censys scanning for internet-exposed PLCs on known OT ports Ports 44818, 2222, 102, 502
Initial Access Exploit CVE-2021-22681 (unprotected cryptographic key) to authenticate without valid credentials Rockwell Studio 5000 Logix Designer, EcoStruxure, TIA Portal
Persistence Deploy Dropbear SSH on victim endpoints for persistent remote access Port 22 / Dropbear SSH binary
Exfiltration Download .ACD project files containing ladder logic and full PLC configuration Studio 5000 file transfer
C2 ChainShell malware uses Ethereum blockchain smart contracts to retrieve C2 server addresses — nearly impossible to sinkhole JavaScript / Ethereum
Impact Falsify HMI/SCADA display values, modify ladder logic, cause operational disruptions CastleRAT, modified PLC firmware

A detailed technical simulation by Picus Security confirms each stage of the kill chain is reproducible. The ChainShell blockchain C2 technique deserves special mention. By embedding C2 server addresses inside immutable Ethereum smart contracts, CyberAv3ngers have made the command infrastructure practically immune to takedown. Even if defenders identify and block known IP addresses, the malware simply queries the blockchain for updated routing — an innovation that signals this group is investing heavily in operational resilience.

CISA’s July 22 Update: What Changed — and Why It Matters

The original advisory (AA26-097A, released April 7, 2026) focused on Rockwell Automation CompactLogix and Micro850 controllers. The July 22 revision made three significant additions:

  1. Expanded vendor scope: Schneider Electric (exploited via EcoStruxure Control Expert) and Siemens (accessed via Totally Integrated Automation (TIA) Portal, identified by traffic on port 102) are now confirmed targets.
  2. New detection guidance: CISA added specific instructions for identifying malicious changes in reusable code modules (Add-On Instructions) within Rockwell PLC programs — a subtle persistence mechanism that can survive a firmware wipe if project files are restored from a compromised backup.
  3. Broadened sector attribution: Beyond water and wastewater systems, the update formally names energy sector and government-services facilities as confirmed victim categories.

As The Record reported, the broadened scope is a direct result of confirmed incidents across multiple PLC brands. For India-based OT operators — many of whom run Schneider Electric SCADA systems in power distribution substations and Siemens S7 PLCs in manufacturing — this update is a direct call to action. Indian critical infrastructure has not been named in the advisory, but the tactics, techniques, and procedures (TTPs) are vendor-agnostic. If your PLC is internet-accessible, you are a viable target.

What You Should Do: A Zero-Trust OT Defence Playbook

Because CVE-2021-22681 has no patch, conventional vulnerability management is insufficient. The defence must be architectural. Here is the prioritised action list drawn from CISA’s guidance and zero-trust OT principles:

  • Immediately remove PLCs from direct internet exposure. Route all OT remote access through a dedicated, authenticated OT DMZ or a zero-trust network access (ZTNA) gateway. No PLC should be reachable on a public IP address. If you need remote access, use encrypted, MFA-protected tunnels — never expose port 44818, 102, 502, or 2222 to the internet.
  • Set physical mode switches to RUN. Rockwell CompactLogix and MicroLogix controllers have a physical keyswitch. Setting it to RUN prevents remote logic modification even if an attacker achieves network access.
  • Enable programming protection and change default credentials. Both Studio 5000 and EcoStruxure support project-level password protection. Enable it now, and rotate credentials from the factory defaults immediately.
  • Back up all PLC logic offline. Store .ACD and equivalent project files on air-gapped, write-once media. Verify backup integrity regularly. If you restore from a backup, verify the backup itself was not modified.
  • Hunt for Dropbear SSH. Scan OT network endpoints for unexpected processes listening on port 22. Dropbear is lightweight and may not appear in standard antivirus scans on embedded devices.
  • Block ChainShell’s Ethereum queries. Restrict outbound connectivity from OT networks. OT devices have no legitimate reason to query public Ethereum nodes. Block all unexpected outbound traffic at the OT perimeter firewall.
  • Audit Add-On Instructions (AOIs) in Rockwell projects. Following CISA’s July 22 guidance, review all reusable code modules for unauthorised changes. Cross-reference current project files against known-good baselines in version control.
  • Enforce MFA on all remote OT access. No exceptions. Privileged access management (PAM) with just-in-time (JIT) access for OT environments significantly reduces the attack surface.

For organisations using FortiGate firewalls at the IT/OT boundary, the Fortinet Security Fabric OT features (including industrial protocol deep inspection for EtherNet/IP and Modbus) can provide visibility into anomalous PLC communication. If you have already deployed FortiGate in your environment, ensure OT-specific security profiles are enabled on the interface connecting your corporate network to the OT segment. This is precisely the kind of segmentation that stops lateral movement from IT into the PLC layer — and it is central to the zero-trust architecture principles this site has been advocating throughout 2026.

The CISA KEV mandate that drove urgent Fortinet patching last week — three CVSS 9.1 FortiSandbox flaws — underscores a broader pattern: federal agencies are accelerating enforcement timelines precisely because adversaries are moving faster. OT environments, traditionally exempt from rapid patch cycles due to uptime requirements, can no longer afford that luxury.

Frequently Asked Questions

Does this advisory affect Indian organisations, or is it only a U.S. threat?

The advisory is U.S.-focused, but the TTPs are entirely vendor- and geography-agnostic. CyberAv3ngers have demonstrated attacks in Israel, the United States, and other countries. Indian power utilities, water treatment facilities, and manufacturing plants that use Rockwell, Schneider Electric, or Siemens PLCs — particularly those with any degree of internet-facing OT connectivity — should treat this advisory as directly applicable. The Indian Computer Emergency Response Team (CERT-In) has not yet issued a parallel advisory, but organisations should act on the CISA guidance without waiting for one.

Why is CVE-2021-22681 still unpatched in 2026?

CVE-2021-22681 relates to how Rockwell’s Studio 5000 Logix Designer handles cryptographic keys. Issuing a patch would require firmware updates across a vast installed base of CompactLogix and MicroLogix controllers — many of which run in validated, certified environments (nuclear, pharmaceutical, food processing) where firmware changes require re-certification. Rockwell has issued hardening guidance instead of a patch. The practical implication: this vulnerability will remain in the field for years, and network-level controls are the only reliable mitigation.

How do I know if my OT network has already been compromised?

Look for: (1) unexpected Dropbear SSH processes or port 22 activity on OT endpoints; (2) unauthorised connections from third-party hosted IP ranges on OT ports (44818, 102, 502, 2222); (3) mismatches between displayed HMI values and physical sensor readings; (4) unexplained changes to PLC project files or Add-On Instructions compared to your baselines; (5) outbound connections from OT endpoints to Ethereum nodes or unfamiliar internet hosts. If you lack OT network visibility tools, engage an industrial cybersecurity specialist immediately.

What is the difference between BAUXITE and PYROXENE?

These are sub-cluster designations used by OT security researchers (particularly Dragos) to organise the CyberAv3ngers threat activity. BAUXITE represents the intrusion cluster responsible for Stage 2 ICS Kill Chain activities — disruption and manipulation of physical processes. PYROXENE is the infrastructure-operator cluster that maintains C2 infrastructure and performs initial access. Understanding the split matters for defenders: BAUXITE is the actor with OT expertise; disrupting PYROXENE’s infrastructure will slow but not stop attacks.

Get a Zero-Trust OT Security Assessment for Your Organisation

If your organisation operates industrial control systems, PLCs, or SCADA infrastructure — whether in manufacturing, utilities, logistics, or government services — now is the moment to assess your exposure. Internet-accessible OT devices with default credentials are not a future risk; they are a present compromise waiting to be discovered.

Sanjay Seth and the team at P J Networks have spent over 30 years securing critical infrastructure across India and the region. From FortiGate OT segmentation to zero-trust network access design and SCADA security audits, we help organisations move from reactive patching to proactive architecture-based defence.

Contact us today for a zero-trust OT security assessment — before CyberAv3ngers’ next scan finds your facility first.