Ongoing Threat Activity Targeting PLCs – Rockwell Automation Important Notice Update

(TLP:CLEAR) WaterISAC is aware that the current threat activity targeting PLC devices is still ongoing and expanding. Additionally, Rockwell Automation recently released an updated notice titled “IMPORTANT NOTICE: Restoring Access to MicroLogix 1400 and MicroLogix 1100 Controllers When the Password is Unknown, and Hardening Guidance.” The notice responds to threat actor activity targeting internet-exposed MicroLogix™ 1400 and MicroLogix 1100 programmable logic controllers (PLCs).

CISA’s recent July 30 alert, “CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs,” already directed owners, operators, and integrators to this Rockwell notice. However, since that alert published, Rockwell has revised the notice. Members who reviewed the earlier version are encouraged to review the new information