#ot-security

Iran-affiliated threat actors infiltrated internet-facing PLCs across U.S. critical infrastructure, manipulating SCADA displays and project files to trigger outages and financial losses in government, energy, and water systems. Suspicious activity spiked on OT ports 44818, 2222, 102, and 502, signalling a sophisticated campaign targeting operational technology at scale.

Source: Internet Crime Complaint Center

Following US military strikes on 28 February 2026, Iranian-aligned hacktivist and nation-state groups rapidly pivoted to target tens of thousands of internet-exposed US industrial control systems — many of which respond to unauthenticated commands and run on default passwords.

Source: CloudSEK

Siemens, Schneider Electric, Aveva, and Phoenix Contact patched high-severity ICS vulnerabilities, preventing unauthorised access, code execution, and privilege escalation across OT environments.

Source: SecurityWeek

Nearly 10,000 exposed industrial control systems from major manufacturers faced attacks, including destructive firmware exploits by Russian-linked Dragonfly targeting power infrastructure.

Source: Team Cymru