Iran-linked hacker group tied to the IRGC's Cyber-Electronic Command, known for targeting industrial control systems, especially Rockwell and Siemens PLCs.
CISA and six partner agencies updated AA26-097A on July 22, extending the vendor scope beyond Rockwell and adding detection guidance for tampered reusable code modules.
Reality
Five US agencies report attackers scanning for exposed S7 PLCs and using a public library to read and write data blocks. The mitigation list reads like a commissioning checklist.
Reality
Amir Yaryab is named as head of the IRGC's Cyber-Electronic Command and the officer directing five hacking crews, which tells water and energy operators who is at the other end of the intrusions without telling them what to hunt.
Reality
Administrator access on Mathspace's self-hosted reporting tool needed no login, and the week's other exposures sat in an unclaimed Elasticsearch cluster and inside an AI provider's shared package cache.
Reality
The count federal agencies had not published arrives attached to a remediation list that begins with taking inventory, which says more about this campaign than the attribution does.
Reality