# Iran's ICS Hackers Just Got a Lot More Dangerous — And They Brought Siemens and Schneider Into the Blast Radius
When federal agencies first warned about Iranian hackers tampering with programmable logic controllers back in April, the scope seemed manageable: Rockwell Automation devices, a handful of sectors, internet-exposed PLCs that probably shouldn't have been exposed in the first place. Wednesday's updated advisory changes the calculus entirely.
The same campaign now officially spans Siemens S7-1200 and Schneider Electric Modicon M340 PLCs — and the feds have acknowledged that other vendors' equipment may also be in the crosshairs. Between those three manufacturers, you've just described a substantial fraction of industrial control infrastructure worldwide. This is no longer a story about opportunistic intrusions into poorly hardened endpoints. It's about a sustained adversary with functional capabilities across the dominant platforms running critical infrastructure.
## What They Actually Did to the PLC Logic
The technical detail buried in the updated advisory deserves more attention than it's getting. This wasn't just unauthorized access. The attackers used *legitimate manufacturer software* — Rockwell's Studio 5000 Logix Designer, Schneider's EcoStruxure Control Expert, Siemens' TIA Portal — to download modified project files to compromised PLCs.
Here's the part that should make every OT security engineer sit up straight: the malicious project files *retained the functional ladder logic.* The systems kept doing their jobs. Operators saw normal displays. The modification didn't break anything in the obvious sense. What it did was add override logic that neutered specific instruction sets responsible for maintaining safe operating parameters.
The advisory puts it plainly: "the changes disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies."
That's not a breach. That's a trap, set and waiting. An operator could watch a system approach a dangerous state and have no indication anything was wrong — because the safety logic that should have screamed was quietly excised from the project file.
The targeted ports confirm this is deliberate, vendor-specific knowledge: 44818 and 2222 for EtherNet/IP (Rockwell), 102 for the S7 protocol (Siemens), 502 for Modbus (Schneider), and 22 for SSH. The attackers aren't scanning blindly. They know which protocols run on which hardware.
## The Handala Escalation Arc
CyberAv3ngers dominated headlines through 2023 and 2024, particularly after the Unitronics water treatment attacks that reached all the way to Municipal Authority of Aliquippa, Pennsylvania. That group operated noisily, favored symbolic targets, and posted screenshots to prove it.
Handala, which has taken the operational lead in 2026, is following a different playbook — and a more alarming one. Their January attack on Stryker, the medical technology giant, was disruptive enough to cause real operational pain to a company embedded in hospital supply chains. In June, they claimed deep access to California Water Service's ICS environment. Cal Water disputed the severity, stating they found no evidence of OT compromise, but the group's claim of accessing water distribution control systems tracks with the technical capability now documented in the federal advisory.
The pattern across these incidents suggests Handala is pressure-testing critical sectors in sequence: healthcare supply chain, municipal water, and now — through the updated advisory — energy and facilities. Whether they're probing for the most damaging entry point or simply expanding their target portfolio, the trajectory points toward a group that is gaining operational confidence with each campaign.
It's worth naming what's not said in the advisory: Iran learned the foundational vocabulary of ICS attacks partly as the victim of Stuxnet, which targeted Siemens S7-300 and S7-400 PLCs in 2010. The current campaign hitting S7-1200 series hardware represents, at minimum, a theoretical symmetry that the advisory's authors have chosen not to articulate publicly.
## What Defenders Actually Need to Do Right Now
The advisory includes new IoCs and detection guidance. That's useful, but it addresses the back half of the kill chain. Here's what matters at the front:
Audit your internet-exposed PLCs this week. The targeted ports — particularly 44818, 102, and 502 — should not be reachable from the public internet. If they are, that's the first problem, and it predates any Iranian threat actor.
Baseline your PLC project files. If you don't have a known-good snapshot of your ladder logic to compare against, you cannot detect the specific modification technique described in this advisory. Integrity monitoring for project files should be treated the same as file integrity monitoring on servers.
Watch for legitimate tool usage in unexpected contexts. The attackers are operating through Studio 5000, EcoStruxure, and TIA Portal — the same applications your own engineers use. Alerts should fire on these tools running outside of maintenance windows or from unfamiliar source IPs, not just on novel malware signatures.
Verify your alarm and shutdown logic is intact. This is uncomfortable, but the advisory's description of attackers specifically targeting safety logic means a functional test of alarm and shutdown behavior is now a security control, not just a maintenance item.
The advisory's new detection guidance includes behavioral indicators for recognizing malicious project file activity. Pull it, read it, and share it with whoever owns your OT security posture — which, in many organizations, is still a question without a clear answer.
---
## HackWire Analysis
The expansion of this advisory from Rockwell to include Siemens and Schneider is the real headline, but the *method* is what should dominate the post-incident conversation that hasn't happened yet.
Disabling safety and shutdown logic while leaving operational logic intact is conceptually identical to what Triton/TRISIS attempted at a Saudi petrochemical facility in 2017 — the attack that the security community widely considers the first malware explicitly designed to cause physical harm to humans by bypassing safety instrumented systems. Triton targeted Schneider Triconex safety controllers. This advisory describes targeting Schneider Modicon M340 process controllers and disabling the safety logic within them. The execution differs, but the objective — making a system able to reach a dangerous state without triggering protective responses — is the same.
Most coverage of this advisory will focus on attribution and the list of vendors. What's missing is that Iran has effectively demonstrated a safety-defeat capability across three major ICS platforms simultaneously. That's not a single threat actor with a niche skill. That's a capability that requires significant investment and institutional knowledge — the kind that gets formalized, shared, and scaled.
The sectors named — energy, water and wastewater, government facilities — are exactly the sectors where a safety logic defeat causes the most consequence. A process running hot without an alarm isn't a ransomware headline. It's an explosion, a contamination event, or a cascade failure that takes months to explain.
The organizations most exposed are those that secured the perimeter but never validated what's inside the PLC. The attackers already know this. They're counting on it.
— HackWire Editorial
---
## Related Coverage