Iranian Cyber Operations Targeting Siemens & Schneider: CISA Alert and Defense Guide

By Senior Security Consultant, Security Arsenal

CISA has issued a critical warning regarding Iranian state-sponsored cyber actors actively targeting U.S. critical infrastructure, specifically focusing on industrial control systems (ICS) manufactured by Siemens and Schneider Electric. This is not a theoretical risk; we are seeing active campaigns aimed at operational technology (OT) environments. For organizations managing these assets, the perimeter has already been conceptually breached—it is now a matter of time and detection.

Introduction

The recent advisory highlights a focused effort by Iranian threat actors to compromise U.S.-based entities utilizing Siemens and Schneider equipment. These adversaries are not merely scanning; they are attempting to manipulate or disrupt industrial processes. The convergence of IT and OT networks has exposed these legacy systems to modern cyber warfare tactics. Defenders must assume that initial access vectors—such as phishing on corporate networks or exposed VPNs—are actively being used to pivot into ICS environments.

Technical Analysis

Affected Products and Scope

While the specific CVEs are not detailed in the current public alert, the targets clearly encompass the ecosystem of:

Siemens: SIMATIC S7-1500 and related automation controllers, TIA Portal engineering workstations, and WINCC HMI systems.
Schneider Electric: Modicon M340/M580 programmable logic controllers (PLCs), Unity Pro/XL engineering software, and EcoStruxure platforms.

Attack Vector and TTPs

Iranian actors typically utilize a "living off the land" approach in OT environments to avoid detection:

Initial Access: Compromise of IT network assets (Windows engineering stations) via standard means (credential theft, phishing), followed by lateral movement into the OT demilitarized zone (DMZ).
Reconnaissance: Scanning for ICS-specific protocols (S7Comm, Modbus) to identify controllers. They often utilize tools like nmap or custom ICS scanners to enumerate assets.
Manipulation: Access to engineering workstations (TIA Portal or Unity Pro) allows the adversary to upload altered logic (code) to PLCs or manipulate HMI tags to hide physical process changes.
Exploitation Status: CISA has confirmed active exploitation. This indicates the actors have moved beyond reconnaissance and are attempting to establish persistence or impact processes.

Vulnerability Context

Although specific 2025/2026 CVE identifiers are not cited in this immediate alert, the attacks likely leverage:

Misconfigurations: Exposed RDP, SSH, or web interfaces (Port 80/443/4800) on HMIs.
Weak Authentication: Default credentials on PLCs or hardcoded passwords in project files.
Known Logic Flaws: Manipulation of proprietary protocols that lack integrity checking.

Detection & Response

Given the active nature of this threat, SOC teams must deploy specific hunting rules for ICS-adjacent assets. The following detection mechanisms focus on the engineering workstations and protocol anomalies often associated with these campaigns.

SIGMA Rules

YAML

---
title: Potential ICS Engineering Software Lateral Movement
id: 8a9b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects engineering software (Siemens TIA Portal, Schneider Unity) initiating network connections to non-local subnets, potentially indicating lateral movement or data exfiltration.
references:
 - https://www.cisa.gov/news-events/cybersecurity-advisories
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.lateral_movement
 - attack.t1021.002
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   Image|contains:
     - 'Siemens.Automation'
     - 'UnityPro'
     - 'ControlExpert'
   DestinationIp|startswith:
     - '10.'
     - '192.168.'
 filter:
   DestinationIp|startswith: '127.'
falsepositives:
 - Legitimate engineering updates or backup processes to known servers
level: high
---
title: Suspicious ICS Protocol Activity From Non-Engineering Hosts
id: 9b1c2d3e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects Modbus or S7 traffic originating from hosts that are not known engineering workstations, suggesting unauthorized PLC access or rogue tooling.
references:
 - https://attack.mitre.org/techniques/T0885/
author: Security Arsenal
date: 2026/04/06
tags:
 - attack.impact
 - attack.t0885
logsource:
 category: network_connection
 product: windows
detection:
 selection:
   DestinationPort:
     - 102
     - 2404
     - 502
   Initiated: 'true'
 filter_legit_host:
   Computer|contains:
     - 'ENG-'
     - 'HMI-'
     - 'OPC-'
condition: selection and not filter_legit_host
falsepositives:
 - Unlisted new engineering workstation
 - Temporary diagnostic laptop
level: critical

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for unusual process execution on potential OT workstations
// Look for typical recon tools or script engines spawned by engineering software
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (ProcessCommandLine contains "S7" or ProcessCommandLine contains "Modbus" or FileName in~ ("TIAPortal.exe", "UnityPro.exe", "ControlExpert.exe"))
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "python.exe", "wscript.exe")
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| order by Timestamp desc

Velociraptor VQL

VQL — Velociraptor

-- Hunt for Schneider Unity or Siemens TIA Portal project files
-- modified in the last 24 hours on engineering endpoints
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs="/*/*/*.ap1*")  // Siemens Project files
WHERE Mtime > now() - 24h
UNION ALL
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs="/*/*/*.sta")   // Schneider Project files
WHERE Mtime > now() - 24h

Remediation Script (PowerShell)

This script audits Windows-based Engineering Workstations for common exposure vectors associated with this campaign.

PowerShell

# Audit ICS Engineering Workstation Security
Write-Host "Starting ICS Workstation Hardening Audit..." -ForegroundColor Cyan

# 1. Check for Firewall Rules allowing RDP/SMB from Any
Write-Host "\n[!] Checking for overly permissive Firewall Rules (RDP/SMB)..."
$PermissiveRules = Get-NetFirewallRule | Where-Object {
    ($_.Enabled -eq 'True') -and 
    (($_.Direction -eq 'Inbound') -and ($_.Action -eq 'Allow')) -and
    (Get-NetFirewallPortFilter -AssociatedObject $_ | Where-Object { $_.LocalPort -in 3389, 445 }) -and
    (Get-NetFirewallAddressFilter -AssociatedObject $_ | Where-Object { $_.RemoteAddress -eq 'Any' })
}

if ($PermissiveRules) {
    Write-Host "CRITICAL: Found open RDP/SMB rules to 'Any'." -ForegroundColor Red
    $PermissiveRules | Select-Object DisplayName, DisplayGroup, Action, Direction | Format-Table
} else {
    Write-Host "PASS: No overly permissive RDP/SMB rules found." -ForegroundColor Green
}

# 2. Identify recent project file changes (Indicators of compromise)
Write-Host "\n[!] Scanning for recently modified ICS project files (last 24h)..."
$Paths = @("C:\Users\", "C:\Projects\")
$Extensions = @("*.ap15", "*.ap16", "*.ap17", "*.zap15", "*.sta", "*.stz", "*.xef")

$RecentFiles = foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -Include $Extensions -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) }
    }
}

if ($RecentFiles) {
    Write-Host "WARNING: Recent ICS project file modifications detected." -ForegroundColor Yellow
    $RecentFiles | Select-Object FullName, LastWriteTime, Length | Format-Table
} else {
    Write-Host "INFO: No recent project file changes detected." -ForegroundColor Green
}

Write-Host "\nAudit Complete." -ForegroundColor Cyan

Remediation

Immediate defensive actions are required to protect Siemens and Schneider environments:

Network Segmentation: Enforce strict VLAN separation between IT corporate networks and the OT environment. Ensure the Purdue Model is strictly adhered to, utilizing firewalls with DMZ architecture for any connections between zones.
Disable Unused Services: On all HMIs and Engineering Workstations:
- Disable RDP (Port 3389) unless absolutely necessary; if required, restrict access via VPN with MFA.
- Disable SMBv1; restrict SMB (Port 445) to specific management hosts only.
Patch Management: While specific CVEs are not listed in this alert, ensure all Siemens and Schneider software (TIA Portal, Unity Pro) and underlying Windows OS are patched against the latest 2025-2026 vulnerabilities. Refer to the Siemens Security Advisories and Schneider Security Advisories for the latest updates.
Access Controls: Implement multi-factor authentication (MFA) for all remote access into the OT network. Review and audit local admin accounts on PLCs and HMIs; eliminate default passwords.
Protocol Monitoring: Deploy passive ICS monitoring (e.g., Nozomi, Dragos, or Claroty) to detect malformed S7Comm or Modbus packets indicative of reconnaissance or manipulation attempts.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub