Picture a night shift operator. The coffee has gone cold. The HMI in front of them is green across the board. Levels are where they should be, pressure is in band, no alarms have come in for hours. The process is running, and by every indication on that screen, it is running normally.
Underneath, someone has changed the logic.
The ladder logic that drives the process downstream is still sitting there doing its job. That is exactly why the screen still looks right. What is missing is the part that was supposed to catch a problem. The critical shutdown logic. The alarm logic. The instruction sets responsible for keeping that process inside safe operating parameters. Those got overridden. The process can now walk straight out of its limits, and nobody in that control room is going to be told.
That is not a thought experiment I made up for a blog post. That is what the FBI observed at a US victim, and it is why the July 22, 2026 update to advisory AA26-097A is worth twenty minutes of your day. The advisory is co-authored by FBI, CISA, NSA, EPA, DOE, US Cyber Command’s Cyber National Mission Force, and Treasury. It is TLP:CLEAR, so you can forward it to your team, your integrator, and your board: ic3.gov/CSA/2026/260722.pdf
Let’s be honest about the part that is not new
A chunk of this advisory is guidance we have been giving for well over a decade. Do not put PLCs directly on the public internet. Change default passwords. Segment your networks. Back things up and test the restore. Turn off services you are not using. Put MFA in front of remote access.
None of that is new. The Unitronics campaign that started in November 2023, where CyberAv3ngers compromised at least 75 devices across multiple sectors including water and wastewater, taught the same lesson. And the advisory notes that malicious ladder logic from that campaign continues to be observed to this day.
I am not going to pretend that repeating “get it off the internet” is fresh insight. I am also not going to be dismissive about it. Fundamentals win every time, and the reason this guidance keeps repeating is not that the agencies are out of ideas. It is that the work is not finished. A repeat advisory is not a failure of the advisory. It is a scoreboard.
The uncomfortable question is not whether you know the fundamentals. It is whether you can prove they are true in your plant this afternoon.
What actually changed on July 22
Five things, and they matter.
It is not just Rockwell anymore. The April version pointed at Rockwell Automation/Allen-Bradley CompactLogix and Micro850 PLCs. The update adds Schneider Electric BMX P34/Modicon M340, Siemens S7-1200, and potentially other branded PLCs. More importantly, the actors are targeting by port: 44818, 2222, 102, and 502, plus modems on port 22. They are not shopping by brand. They are scanning for anything that answers.
The project file became the weapon. At one US victim, the actors downloaded a malicious project file to a PLC using configuration software. The file kept the valid ladder logic for downstream function and added logic that overrode the instruction sets maintaining safe operating parameters. Shutdown and alarm logic disabled, systems free to enter unsafe conditions without notifying operators. Read that again. The process keeps running. The screen looks fine. The alarm does not come.
They hid changes inside reusable code modules. The advisory calls out modification and deletion of project file logic including Add-On Instructions. An AOI in Rockwell is the same idea as a Function Block or User Defined Function Block in other vendors’ programs.
They stole project files first. Using the vendors’ own engineering software, Studio 5000 Logix Designer, EcoStruxure Control Expert, and Siemens TIA Portal, running on leased third party hosted infrastructure, the actors exfiltrated device project files out to their own infrastructure. Our engineering tools, pointed at our controllers.
They left a way back in that is not the PLC. In one reported instance they deployed Dropbear SSH on victim modems to keep remote access through port 22.
And the new indicator tables show actor-associated IP addresses active through July 2026. This is current activity, not history.
Why an operator should care
Here is the thing. This is not smash and break. Anyone can crash a controller. Keeping the process running while quietly removing the safety net takes intent, and it takes homework.
That is what the exfiltration piece is really about. The project file is the process knowledge. It is how the plant thinks. Take it offline, study it at your leisure, and you can engineer a change that survives a casual glance from a busy engineer. Then hide it inside an AOI or a function block, because reusable modules are trusted by design. We write them once, reuse them across programs, and almost nobody re-inspects them. An integrity check that eyeballs the main routine and calls it good misses this entirely.
Add the cross-vendor targeting and one more comfortable assumption goes away. “That’s a Rockwell advisory, we run Siemens” does not hold when the scan is looking for anything answering on 102 and 502.
I talk a lot about two identical PLCs. One runs a turbine. One runs the ice machine in the break room. Same model, same firmware, same vulnerability, wildly different consequence. That is still how you prioritize the work. Just understand that the scanner on the other end does not know which one it found. It only knows something answered. Your exposure is opportunistic. Your impact is not. Sort by impact and start there.
The modem detail matters for the same reason. Too many OT networks are a hard candy network, hard shell outside, soft and gooey in the middle. A modem at a remote site is a second door into that soft center. Kicking someone off the PLC does not help if they still own the modem.
Who is most likely to feel this
Risk is likelihood and impact, not a CVSS score. The likeliest victims here are exactly who the advisory names. Water and wastewater systems. Local municipalities. Energy. Small sites running lean, where one person owns IT, OT, and the phone system, and where a controller went on a modem years ago because that was the only way to see the remote site.
If you have real segmentation, nothing answering on those ports from the internet, and a known-good logic baseline, this specific campaign is very likely not knocking on your door. That is worth knowing. It is not a reason to skip the checks below.
And notice what this campaign went after. Shutdown logic. Alarm logic. Safe operating parameters. That is not a cyber problem with a safety flavor. That is a safety problem with a cyber cause. Security supports safety. This advisory just handed you the evidence for that argument.
What to do this week
- Find out what answers from the internet on ports 44818, 2222, 102, 502, and 22. Include remote sites and cellular modems. Ask your ISP and your integrator, run an external exposure review, or use CISA’s no-cost cyber hygiene services. Do not assume.
- Get anything you find behind a secure gateway or firewall so nothing is directly reachable, and lock down PLC access with ACLs that only allow expected control system devices to talk.
- Query the IOCs against your logs, and look for traffic on those OT ports from foreign hosting providers. Vet the IPs before you block.
- Pull the running logic off your critical controllers and compare it to known good using the vendor integrity tools. Include the AOIs, function blocks, and I/O configuration, not just the main routine.
- Validate backups before you restore anything. A backup with malicious logic in it is not a rescue, it is a redeployment.
- Change default passwords on the devices and the modems. Long, random, unique.
- Put the physical mode switch in RUN, after you validate the project file. Switching modes locks in whatever is currently downloaded. Validate first, then switch.
- Check the modems, HMIs, and engineering workstations. Review logs and configurations for lateral movement. If the actors reached other devices, reimage them.
- Tell your service providers and integrators there is an active threat. Some of them rely on internet connectivity to monitor your sites and may not have seen this advisory.
- If something looks off, make the calls. Rockwell PSIRT, Schneider CPCERT, Siemens ProductCERT, CISA, and the FBI contacts are all listed in the advisory. That is what they are there for.
Nobody at your site cares about cybersecurity for its own sake. They care about a plant that is reliable, available, and safe. Alarms and shutdowns are the last line between a bad day and a very bad day, and this campaign goes after exactly that layer while keeping the screen looking calm.
Go verify your logic. Then go verify your exposure.
Stay safe and secure out there. Let’s get to work, and let’s protect it all.