CISA, the FBI, EPA, and U.S. government partners have issued an updated joint cybersecurity advisory warning of ongoing Iranian-affiliated cyberattacks targeting internet-connected programmable logic controllers across U.S. critical infrastructure — with water and wastewater systems explicitly named among affected sectors.
Originally published in April 2026, the updated advisory expands the scope of known PLC targeting beyond Rockwell Automation to include Schneider Electric and Siemens devices, and adds new guidance for detecting malicious changes in reusable PLC code modules. Iranian-affiliated actors have successfully disrupted PLCs by downloading malicious project files and manipulating HMI and SCADA displays, causing operational disruptions and financial losses for affected organizations.