Iranian APT Rockwell PLC Targeting
Abstract
On April 7, 2026, the FBI, CISA, NSA, EPA, DOE, and U.S. Cyber Command jointly disclosed ongoing exploitation of internet-facing Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs) by Iranian-affiliated APT actors. Censys data identifies 5,219 internet-exposed hosts globally responding to EtherNet/IP (EIP) and self-identifying as Rockwell Automation/Allen-Bradley devices the attack surface directly relevant to AA26-097A. The United States accounts for 74.6% of global exposure (3,891 hosts), with a disproportionate share on cellular carrier ASNs indicative of field-deployed devices on cellular modems. Censys pivoting of the published IOC list reveals that CISA's seven 185.82.73.x indicators represent a single multi-homed Windows engineering workstation running the full Rockwell toolchain, with four additional operator IPs on the same host absent from the advisory.