Iranian-Linked APT Actors Target PLCs Across U.S. Critical Infrastructure

    Monday, July 27, 2026 In: Threat Research Print

    Date: 07/23/2026

    Severity: Critical

    Summary

    Iranian-affiliated APT actors, including activity linked to CyberAv3ngers, are targeting internet-connected Programmable Logic Controllers (PLCs) across U.S. critical infrastructure sectors, including Government Services and Facilities, Water and Wastewater Systems, and Energy. The attackers manipulate PLC project files, HMI/SCADA displays, and operational processes to cause disruption and financial loss, targeting Rockwell Automation, Schneider Electric, Siemens, and other OT devices exposed to the internet.

    Indicators of Compromise (IOC) List 

    IP Address

    185.82.73.175

    141.11.164.153

    175.110.121.42

    175.110.121.39

    175.110.121.41

    175.110.121.107

    192.142.54.79

    84.200.205.165

    185.225.17.225

    79.133.46.209

    88.80.150.199

    88.80.150.200

    88.80.150.202

    185.82.73.162

    185.82.73.164

    185.82.73.165

    185.82.73.167

    185.82.73.168

    185.82.73.170

    185.82.73.171

    135.136.1.133

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    dstipaddress IN ("185.82.73.175","79.133.46.209","135.136.1.133","88.80.150.202","185.82.73.162","175.110.121.39","185.82.73.164","141.11.164.153","185.225.17.225","192.142.54.79","88.80.150.200","185.82.73.170","175.110.121.41","175.110.121.42","84.200.205.165","88.80.150.199","175.110.121.107","185.82.73.165","185.82.73.167","185.82.73.168","185.82.73.171") or srcipaddress IN ("185.82.73.175","79.133.46.209","135.136.1.133","88.80.150.202","185.82.73.162","175.110.121.39","185.82.73.164","141.11.164.153","185.225.17.225","192.142.54.79","88.80.150.200","185.82.73.170","175.110.121.41","175.110.121.42","84.200.205.165","88.80.150.199","175.110.121.107","185.82.73.165","185.82.73.167","185.82.73.168","185.82.73.171")

    Reference:    

    https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a                          


    Tags

    Threat ActorCISAAPTIranUnited StatesCritical InfrastructureGovernment Services and FacilitiesWater and Wastewater SectorEnergyFinancial ServicesExploit

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.