What ports should I watch for Iranian hacker activity on PLCs?

Ports 44818, 2222, 102, 22, 502—especially overseas traffic. Log 'em, block 'em.

How do Iran-backed actors access Rockwell PLCs?

Via Studio 5000 Logix Designer, faking connections from third-party hosts. Check your engineering workstations.

Will this Iranian OT campaign escalate?

Likely—ties to geopolitics. Segment now, or regret later.

Iran's Hackers Gut US Water Plants—Via Exposed PLCs

Iran's hackers are back, jabbing at US water systems and energy grids through idiotically exposed PLCs. CISA's screaming for fixes, but is anyone listening?

theAIcatchup Apr 08, 2026 4 min read

Digital map of US with red alerts on water plants and energy grids targeted by Iranian hackers

⚡ Key Takeaways

Iran-backed hackers target exposed Rockwell PLCs in US water, energy, gov sectors. 𝕏
CISA urges log hunts, segmentation, physical PLC locks—basic fixes ignored too long. 𝕏
Expect escalation: cyber probes today signal physical disruptions amid tensions. 𝕏

Published by

theAIcatchup

Threat intelligence. Zero noise.

#CISA advisory #CNI attacks #Iran hackers #Iranian hackers #OT security #OT vulnerabilities #Rockwell PLCs #US CNI attacks

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by InfoSecurity Magazine

⚡ Key Takeaways

The 60-Second TL;DR

theAIcatchup

Share this article

Worth sharing?

Related Stories

Iran's Hackers Crack Open America's Industrial Controls

Iran's Hackers Spray Passwords at 300+ Israeli Microsoft 365 Targets—And It's Just Getting Started

Iranian Hackers Are Back, Prodding U.S. PLCs in Water Plants and Power Grids

Iran Hackers Cripple US Water and Energy PLCs in Coordinated Strikes

Stay in the loop