Key Takeaways
- The Cybersecurity and Infrastructure Security Agency (CISA), together with U.S. and international partners, issued an updated advisory on July 22 detailing Iranian‑affiliated cyber activity targeting programmable logic controllers (PLCs) used in healthcare and other critical sectors.
- The warning expands beyond the original April alert on Rockwell Automation PLCs to include Schneider Electric, Siemens, and potentially other PLC manufacturers.
- Adversaries are observed inserting malicious changes into reusable code modules within PLC programs, allowing them to manipulate equipment operation while evading traditional signature‑based defenses.
- The advisory provides specific detection guidance, indicators of compromise (IOCs), and mitigation steps for organizations that rely on PLC‑based systems.
- Healthcare entities are urged to review their PLC inventories, apply network segmentation, enforce least‑privilege access, and monitor for unauthorized code alterations to reduce risk.
Introduction and Context
On July 22, the Cybersecurity and Infrastructure Security Agency (CISA) released an updated joint advisory with several U.S. federal agencies and international partners concerning cyber threats posed by Iranian‑affiliated threat actors. The advisory focuses on attacks targeting internet‑connected programmable logic controllers (PLCs), which are specialized computers that monitor and control physical equipment in industries such as manufacturing, energy, water treatment, and healthcare. Although PLCs have long been considered a niche target, their increasing connectivity to corporate networks and the internet has expanded the attack surface, making them attractive to nation‑state actors seeking to disrupt critical infrastructure or gather intelligence. The updated notice builds upon an initial warning issued in April and reflects the evolving nature of the threat landscape.
Overview of PLCs and Their Use in Healthcare
Programmable logic controllers serve as the brains behind many automated systems, executing logic‑based commands to regulate machinery, environmental controls, access mechanisms, and safety interlocks. In healthcare settings, PLCs are commonly embedded in heating, ventilation, and air‑conditioning (HVAC) systems, medical gas delivery, sterilization equipment, pharmacy automation, and even certain imaging devices that require precise environmental conditions. Because these controllers often operate 24/7 and are integral to patient safety and operational continuity, any compromise can have direct clinical consequences, ranging from uncomfortable environmental conditions to potential harm if life‑supporting systems are altered. The growing reliance on networked building management systems further links PLCs to hospital IT infrastructures, creating pathways for cyber adversaries to pivot from corporate networks to operational technology (OT) environments.
Initial Warning (April) on Rockwell Automation PLCs
The first advisory, issued in April, highlighted a series of intrusions in which threat actors gained unauthorized access to Rockwell Automation PLCs deployed across multiple sectors. The actors exploited weak remote‑access configurations, default credentials, and unpatched vulnerabilities in the PLCs’ firmware or associated engineering workstations. Once inside, they were able to modify ladder logic programs, potentially causing equipment to behave unpredictably or to shut down. The April notice urged organizations to inventory their Rockwell‑based PLCs, disable unnecessary remote services, enforce multi‑factor authentication, and apply the latest security patches. It also recommended monitoring for unauthorized changes to program files and implementing network segmentation to isolate OT from corporate IT networks.
Updated Advisory (July 22) Scope Expansion
The July 22 update broadens the scope of the original warning, confirming that the Iranian‑affiliated group has been observed targeting PLCs from additional manufacturers beyond Rockwell Automation. Specifically, the advisory cites activity against Schneider Electric and Siemens PLCs, with indications that other vendors may also be at risk. This expansion reflects the adversaries’ tactic of seeking widespread impact by exploiting commonalities in PLC programming environments and communication protocols, such as Modbus, EtherNet/IP, and PROFINET. By diversifying their target set, the threat actors increase the likelihood of finding vulnerable devices across a broader range of healthcare facilities and critical‑infrastructure sites, thereby amplifying the potential disruption of their campaigns.
Details on Targeted Manufacturers: Schneider Electric, Siemens, and Others
Schneider Electric and Siemens are two of the largest global suppliers of PLCs, with their products widely deployed in hospital building automation, laboratory equipment, and pharmaceutical production lines. The advisory notes that observed intrusions involved the exploitation of publicly known vulnerabilities in these vendors’ firmware, as well as the use of compromised engineering workstations that had legitimate access to the PLC development environments. In some cases, attackers leveraged legitimate remote‑maintenance ports that were inadvertently exposed to the internet. The advisory stresses that while the specific CVEs (Common Vulnerabilities and Exposures) exploited may vary, the underlying pattern—gaining entry via weak remote‑access controls and then altering control logic—remains consistent across manufacturers.
Tactics, Techniques, and Procedures (TTPs) of Iranian‑affiliated Actors
The threat actors behind these campaigns employ a blend of classic OT‑focused techniques and more sophisticated IT‑to‑OT pivoting strategies. Initial access frequently stems from phishing emails that deliver malicious attachments or links to compromised websites, thereby harvesting credentials for engineering workstations or VPN gateways. Once inside the IT network, the actors conduct lateral movement using stolen credentials, exploiting unpatched software, and abusing legitimate remote administration tools (e.g., RDP, SSH). Upon reaching the OT zone, they target PLC programming software (such as Rockwell Studio 5000, Schneider Unity Pro, or Siemens TIA Portal) to inject or modify reusable code modules—functions, subroutines, or libraries that are called repeatedly across multiple ladder logic rungs. This approach allows a single malicious alteration to propagate throughout the control program, maximizing impact while minimizing the amount of code that needs to be changed.
Malicious Changes in Reusable Code Modules
A notable development highlighted in the updated advisory is the adversaries’ focus on inserting malicious logic into reusable code modules within PLC programs. Rather than altering a single rung of ladder logic, attackers modify shared functions that are invoked by numerous parts of the control program, such as alarm handling, safety interlocks, or set‑point calculations. By corrupting these modules, the threat actors can cause subtle but persistent deviations in equipment behavior—such as causing HVAC systems to drift outside safe temperature ranges, disabling safety trips, or altering medication dosing rhythms—without triggering obvious alarms that would alert operators to a blatant program change. Because these modifications reside in reusable components, they may evade traditional integrity‑checking tools that only scan for changes to the main program file, underscoring the need for deeper code‑review practices and version‑control monitoring.
Detection Guidance and Indicators of Compromise
To assist defenders, the advisory supplies a set of detection recommendations and specific indicators of compromise (IOCs). Organizations are encouraged to enable detailed logging on PLC engineering workstations, network devices, and remote‑access gateways, focusing on authentication events, file‑creation/modification timestamps, and unusual command‑line arguments. Indicators include the presence of unknown or unexpectedly modified .L5K (Rockwell), .XML (Schneider), or .STEP (Siemens) files, as well as anomalous outbound connections from engineering workstations to unfamiliar IP addresses or domains. The advisory also recommends deploying integrity‑monitoring solutions that hash critical PLC program files and alert on any deviation, coupled with behavioral analytics that flag deviations in expected PLC scan‑cycle timing or I/O patterns.
Recommendations for Healthcare Organizations
Healthcare entities should treat PLCs as critical assets and apply a defense‑in‑depth strategy. First, conduct a comprehensive inventory of all PLCs, documenting make, model, firmware version, and network location. Second, enforce strict remote‑access controls: disable unnecessary services, require multi‑factor authentication, and place engineering workstations in a segregated VLAN with firewall rules that permit only essential protocols. Third, adopt a patch‑management process that tracks vendor advisories for both PLC firmware and associated engineering software. Fourth, implement code‑integrity controls—such as signed scripts, version‑control repositories, and periodic hash comparisons—to detect unauthorized modifications to reusable modules. Fifth, segment OT networks from IT and corporate networks using unidirectional gateways or firewalls with deep‑packet inspection, and monitor traffic for signs of reconnaissance or command‑and‑control activity. Finally, develop and test an incident‑response plan that includes OT‑specific playbooks, ensuring that clinical engineering staff and IT security teams can coordinate rapidly when a PLC anomaly is detected.
Role of CISA and International Partners
CISA’s issuance of the advisory underscores its commitment to safeguarding the nation’s critical infrastructure by sharing timely threat intelligence with both public and private sectors. The joint nature of the notice—incorporating input from the Federal Bureau of Investigation (FBI), the Department of Energy (DOE), the Department of Health and Human Services (HHS), and allied nations’ cyber‑security agencies—demonstrates a coordinated effort to attribute the activity to Iranian‑affiliated actors and to provide actionable guidance across sectors. By disseminating IOCs, mitigation advice, and contextual analysis, CISA enables healthcare organizations and other critical‑infrastructure owners to prioritize defenses, allocate resources effectively, and contribute to a broader collective defense posture against state‑sponsored OT threats.
Contact Information and Resources
For further assistance or clarification regarding the advisory, stakeholders may reach out to John Riggi, AHA national advisor for cybersecurity and risk, at [email protected], or Scott Gee, AHA deputy national advisor for cybersecurity and risk, at [email protected]. The American Hospital Association also maintains a dedicated cybersecurity hub at aha.org/cybersecurity, where users can access the full advisory, supplemental technical reports, best‑practice guides, and updates on emerging threats. Regularly consulting these resources helps ensure that healthcare providers remain aware of evolving risks and can adapt their security programs accordingly.
Conclusion and Call to Action
The updated July 22 advisory reveals a persistent and evolving threat: Iranian‑affiliated cyber actors are leveraging access to engineering workstations to stealthily tamper with reusable code modules inside PLCs from multiple vendors, including those ubiquitous in healthcare facilities. Although the intrusions so far have shown a focus on reconnaissance and preparatory steps, the potential for consequential disruption to essential building systems, medical equipment, or pharmaceutical processes is significant. Healthcare leaders must act now—inventorying assets, hardening remote access, enforcing code integrity, segmenting networks, and cultivating a robust incident‑response capability—to protect patient safety and maintain operational resilience. By following the guidance provided by CISA and its partners, organizations can reduce the likelihood of a successful compromise and ensure that their critical control systems remain trustworthy and secure.