They Left Your Ladder Logic Running and Deleted the Safety Limits. CISA Updated AA26-097A and Nobody Read the Important Paragraph.

On July 22 the FBI, CISA, NSA, EPA, DOE, Cyber Command, and Treasury updated joint advisory AA26-097A on Iranian-affiliated targeting of internet-exposed programmable logic controllers. The headline everyone picked up was "new detection guidance for Rockwell reusable code modules." That is the least interesting sentence in the update. Two others matter far more, and one of them describes an attack shape we have been writing about all year under a different name.

If you run PLCs, here is the whole thing up front: the vendor scope expanded past Rockwell to Schneider Electric and Siemens, and the FBI observed a malicious project file that kept the working logic intact and removed only the instructions enforcing safe operating limits. Ports to check tonight are 44818, 2222, 102, and 502 on the controllers, and 22 on the modems.

The paragraph that should scare you

Quoting the update: at one U.S. victim, the actors downloaded a malicious project file to a targeted PLC using legitimate configuration software. Analysis showed the project file retained ladder logic for downstream function but added logic that overrode specific instruction sets responsible for maintaining safe operating parameters.

Read that twice. The process still runs. The HMI still looks right. Product still moves down the line. What is gone is the envelope — the interlocks and limit checks that stop a pump, a valve, or a heater before it does something physical and irreversible. The plant appears healthy right up until the moment it is asked to operate near a boundary that no longer exists.

This is the inverse of every OT attack story people are trained on. Nobody expects the quiet version. The Unitronics defacements that first put this crew on the map were loud on purpose — screens changed, flags waved, an obvious message. This is the opposite discipline: change nothing an operator would notice, remove only the thing that protects them.

We have a name for this: Pattern 52

We call it the subtraction attack. It is the class of technique that wins by deleting an artifact the defense assumes is present, rather than by adding a payload the defense might catch. No malware to sign. No C2 beacon to flag. No anomalous process to alert on. The attack is an absence, and absence is the single hardest thing for a monitoring stack to see, because almost every detection we build is a detector of presence.

Safety instructions inside PLC ladder logic are a near-perfect target for it. They are the definition of something everyone assumes exists and nobody re-reads. Ask an honest question about your own plant: when did anyone last diff the running logic in a controller against the engineering baseline? Not the firmware version — the logic. For most sites the truthful answer is "at commissioning," and that was years ago.

That is also why the new Rockwell reusable-code-module guidance is the practically useful part of this update. Reusable modules are exactly where subtracted safety logic hides best, because they are trusted-by-default building blocks that engineers copy and stop reading. Shared, assumed-correct, rarely audited.

They still are not using zero-days

In April we wrote a post titled "4,000 US Industrial Devices Exposed to Iran. They're Not Using Zero-Days. They're Reading the Manual." The July update does not overturn that; it reinforces it. The initial access described is leased third-party hosted infrastructure plus the manufacturer's own PLC programming software, pointed at misconfigured controllers reachable from the internet. That is the documented method. Not an exploit chain. The vendor's supported tooling, used exactly as designed, against a device that should never have been listening to the open internet.

Which is why the expansion to Schneider Electric and Siemens is unsurprising and important at once. If the technique is "connect to an exposed controller with the vendor tool," then it was never Rockwell-specific — it was internet-exposure-specific. The advisory now says potentially all internet-exposed PLCs, and it is right to. Anyone who read the April version as a Rockwell problem and moved on has been reading it wrong for three months.

What to do, in priority order

Get the controller off the internet. This is the whole ballgame and everything below is a distant second. No PLC needs a public IP. Put it behind a firewall, a VPN, or a jump host on an out-of-band management path.

Block the protocol ports at the edge. 44818 and 2222 (EtherNet/IP and CIP), 102 (S7comm, the Siemens path now in scope), 502 (Modbus). Deny inbound from the internet outright. Watch 22 on any cellular modem or gateway fronting the plant.

Diff your running logic against the engineering baseline. This is the control that actually detects what the FBI described, and hardly anyone does it. Pull the project from the controller and compare it to your source of truth, paying specific attention to safety interlocks and limit checks. Give reusable and library modules extra scrutiny — that is where the new CISA guidance points, and it points there for a reason. If you have no baseline to diff against, creating one is now urgent work, because without it a subtraction is undetectable by definition.

Alert on project-file downloads to controllers. A project download is a rare, planned, human event. It should generate a page every single time, correlated against a change ticket. If an unscheduled download can happen quietly in your environment, you have no coverage for this attack at all.

Check the HMI and SCADA layer too. The advisory documents manipulation of what those displays show. Do not treat a normal-looking screen as evidence that the process is normal; that assumption is the one being attacked.

What we fed, and what we did not

We ingested all 21 network indicators from both waves of this advisory — the 8 from the original April 7 bundle and the 13 added on July 22 — into our IOC feed, attributed to the CyberAv3ngers lineage at confidence 90, so they flow into our public IP blocklist and CSV feeds. If you cannot parse a STIX bundle, you can pull a CSV and block the list.

Two honest notes on that.

First, these are CISA's indicators, not our detections. We are redistributing a public government advisory to defenders who cannot easily consume the original format. That has real value if you are a small water utility with no CTI budget, and it is worth nothing as a claim of speed, so we are not making one. Their receipt, not ours.

Second, checking our own feed before writing this turned up something we should say out loud: we had 60-plus published posts on this actor lineage and exactly one indicator in the feed for it — a single malware hash imported from XLab and Claroty research. Every network indicator in an advisory we covered twice was missing. We found that by auditing ourselves against our own rule that says covering a campaign is not finished until its indicators are in the feed. The rule caught us. That is what the rule is for, and the gap is now closed.

Worth noting what we did not feed: the companion Russian router advisory published this month, AA26-194A, contains no network indicators at all — the SNMP requests in that campaign come from spoofed source addresses, so there is nothing meaningful to block. Sometimes the honest output of an IOC review is that there are no IOCs.

The point

The loud version of an OT attack changes your screen. The version in this advisory changes nothing you look at and removes something you never look at. If your entire OT detection strategy is built to spot things that appear — new files, new processes, new connections — then it is structurally blind to the technique the FBI just documented at a real American victim.

Take the controllers off the internet, then go read your own ladder logic. Not the firmware version. The logic. Compare it to what your engineers thought they deployed and find out whether the safety envelope you are betting the plant on is still in there.

We are about 95% confident on the technical read above; the residual is exactly where it always is — the advisory describes what investigators found at the victims who were discovered, and the interesting question is always how many were not.

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com