They didn't turn anything off. They edited the logic and the screen.

When did you last prove that the logic running in one of your controllers is the logic you wrote?

Not do you have a copy of the program. Almost everyone has a copy of the program somewhere, and a copy is not the same as being able to demonstrate a match. Prove that what is executing in the rack right now is that program.

Most plants cannot, and it is not a discipline failure. There has never been a tool that makes it routine, the way git status is routine for everybody who writes software. So the question does not get asked, and the honest state of most estates is that the controller is the only authority on what the controller does.

That is the gap a joint advisory walked straight through this year.

What the advisory says, and the half nobody quoted#

AA26-097A was issued in April by the FBI, CISA, NSA, EPA, DOE, Cyber National Mission Force and the Treasury, and substantially expanded on 22 July. It describes Iranian-affiliated actors, publicly tracked as CyberAv3ngers and linked to the IRGC's Cyber Electronic Command, reaching controllers across US critical infrastructure.

The part that got reported is the part everyone already agrees about: the devices were reachable from the internet and insufficiently hardened. The advisory names Rockwell Automation Allen-Bradley CompactLogix and Micro850, Schneider Electric BMX P34 and Modicon M340, and Siemens S7-1200, on ports 44818 and 2222, 102, 502 and 22. Those are not exotic. They are EtherNet/IP, S7 communications, Modbus and SSH — the ordinary front doors of an ordinary plant.

Then the advisory keeps going, and the second half is much more interesting than the first.

No malware. Your own engineering software.#

The actors did not need a bespoke implant. They ran the manufacturers' own PLC programming software, from leased hosting, and used it the way an engineer would: they took the project file off the controller, and later downloaded a modified one back.

Sit with what that means for detection. On the wire it is a normal engineering session. In the controller's own logs it is a normal download. Every security product on the estate is watching for something that does not belong, and what arrived was the vendor's tool doing the vendor's job.

The stolen project file is worth a sentence of its own, because a project file is not a backup. It is the plant: the interlocks, the sequences, the addresses, the tuning, and every assumption an engineer ever encoded about how the process behaves. It is the single most complete description of your operation that exists, and it is not usually treated as though it were.

What an Add-On Instruction change actually costs you#

The advisory says the actors modified and deleted project file logic, to include Add-On Instructions. That phrase is doing a lot of work, and it is worth unpacking for anyone who does not live in Rockwell's world.

An Add-On Instruction is a reusable block. You define the behaviour of a pump, or a valve, or a permissive, once, and then instantiate it everywhere that thing exists. It is good practice. It is the reason a modern program is maintainable at all. It also means that a single edit to one definition changes behaviour in every place that definition is used, at once, without anything else in the program appearing to change.

Which is why the July revision of the advisory added guidance specifically on detecting malicious changes to reusable logic. Somebody worked out that this is where an edit hides best.

They disabled the two things that exist to protect you from yourself#

The next line of the advisory is the one I keep coming back to: the changes disabled critical shutdown and alarm logic.

Those are not two features among many. They are the two mechanisms that exist for exactly this moment. Shutdown logic is how the plant stops hurting itself when nobody is looking. Alarm logic is how the plant tells a human that something is wrong. Removing both does not damage anything by itself. It removes the estate's ability to react to damage.

And then they changed the picture#

The advisory also reports that the actors altered data displayed on HMI and SCADA displays.

Every other layer of defence assumes the operator is the last one. Someone looks at the screen, notices the number is wrong, and acts. That assumption is load bearing across the whole industry, and it holds only while the screen is telling the truth.

An operator watching a manipulated display is not being careless. They are doing precisely what they were trained to do, with the only instrument they were given.

Minnesota, stated carefully#

The event people connect to this happened on 26 and 27 July, when more than thirty community water systems in Minnesota reported that automated control functions had been affected. In Braham, the attackers shut down the operating controls, which stopped the well and the treatment plant; the town briefly took the plant offline. Most of the affected utilities kept running on contingency procedures, and the cities confirmed drinking water remained safe. Reporting since has extended the pattern to at least six other states.

Two things about it deserve more care than they have generally been given. Investigators have not attributed the Minnesota incidents to any specific actor. CyberAv3ngers fits the profile, and so do others, and fitting a profile is not attribution. And in at least one city the affected equipment was on cellular connections, which is a very different door from the one the advisory describes.

I would rather say that plainly than borrow the advisory's attribution to make the story tidier.

Being fair about who this applies to#

This campaign needed controllers that were reachable from the internet and thinly hardened. If your PLCs are genuinely not reachable — and most plants cannot list who can reach them — you are not in its target set, and telling you otherwise would be scaremongering.

But separate the intrusion from the detection gap, because only one of them is about Iran. Ask the question at the top of this piece in a plant with immaculate segmentation and no internet exposure whatsoever, and the answer is still usually no. Nobody diffs a controller. Which means the far more likely author of an unexplained logic change in your estate is not a foreign service. It is a contractor at two in the morning at the end of a shutdown, doing their best, with no record of what they changed — and you would find that out the same way you would find out about the other one, which is to say eventually, by accident.

The fix at the top of the advisory is a piece of plastic#

Among the recommended mitigations, alongside taking controllers off the public internet and putting real access control in front of them, is this: put the physical mode switch in RUN.

A controller in RUN will not accept a remote program change. No credential, no network path and no clever session gets around a switch that is not in the right position, because the refusal is not implemented in software. Seven agencies investigated a state-affiliated campaign and one of the things they recommend is that somebody walk to the panel and turn a switch with their hand.

It is not sufficient. It stops remote modification, not the reading of your process or the theft of a project file, and it costs you the ability to change anything without a trip to site, which on a distributed estate is a real operational bill. Decide that deliberately rather than by default, which is how most of them ended up in REMOTE.

The thing to actually go and do#

Pick one controller. Upload what is running in it, and compare it against what you believe is in it — the copy in version control, or the file the integrator handed over at commissioning.

The most common outcome of that exercise is not that you find an intruder. It is that you discover you have nothing meaningful to compare against, because the only copy is on a laptop or in a folder named with a date, and what nobody wrote down never gets checked. That is the finding. Fix that, and the question at the top of this article becomes answerable in a morning instead of never — which is worth doing for the contractor at two in the morning, entirely independently of anybody's foreign policy.

A firewall that understands the controller's protocol can refuse a program download from everything except the engineering PC, while the HMI keeps reading and writing its setpoints. Where that fits in a plant's segmentation: one firewall is not segmentation.