Last Updated On
Iranian Hackers Quietly Kill Safety Logic on US Water Plants
Iranian operators are not probing US water and power plants for sport. They are logging into internet reachable PLCs from rented overseas servers, opening the same engineering suites your crews use, and quietly rewriting shutdown and alarm logic while the HMI still paints a calm picture.
The same news day is messier than one campaign. Federal teams are told to rush a Langflow RCE on AI agent boxes, South Korea admits a ten month hole in a diplomatic academy that exposed thousands of MFA identities, Upbound watches roughly thirteen million USD in fake Acima leases walk out the door, Stadler refuses a roughly twelve point three million USD Everest bill after a supplier file portal breaks, and an Adobe Chrome extension path peels open WhatsApp Web chats.
If you only do one thing before Monday, pull every PLC engineering face off the public internet and put MFA gated jump hosts in front of what remains. Then inventory Langflow, raise diplomatic spear phish guards, choke fraudulent origination, map supplier exchanges, and strip risky browser extensions. Architecture is the vulnerability. Delay is the exploit.
0
CVSS Score
20
IOC Count
6
Source Count
78
Confidence Score
No single unified CVE list covers every cluster in this daily brief. Consulted sources separate cleanly into an OT sabotage advisory that is explicitly not CVE driven, and a mixed High severity portfolio where several technical identifiers remain incomplete in retrieved full text.
Iranian affiliated APT IRGC CEC aligned CyberAv3ngers Shahid Kaveh Group Hydro Kitten Storm 0784 Bauxite Mr. Soul Soldiers of Solomon UNC5691, Everest, Under Attribution
Water and Wastewater Systems, Energy, Government Services and Facilities, Financial Services, Diplomacy and Foreign Affairs, Manufacturing and Rail Transportation, Consumer Retail lease to own, Software and AI Agent Platforms, Enterprise Browser and Collaboration
United States, North America, Europe Switzerland, Asia Pacific South Korea, diplomats worldwide
Chapter 01 - Executive Overview
Iranian affiliated APT actors aligned with IRGC Cyber Electronic Command are not theorizing about US critical infrastructure. They are on the wire, reaching internet exposed PLCs in water, energy, and municipal environments, then rewriting safety logic with the same engineering tools your teams trust.
While OT defenders chase open ports 44818, 2222, 102, 502 and modem SSH 22, the same news cycle brings a CISA pushed Langflow RCE on AI agent platforms, a ten month South Korean diplomatic personnel breach, a roughly 13 million USD lease fraud wave at Upbound Acima, a roughly 12.3 million USD Everest demand Stadler rejected, and an Adobe Chrome extension path into WhatsApp Web chats.
This is not one botnet. It is a decision stack: pull PLCs off the public internet, patch or isolate Langflow, harden diplomatic email trust, choke fraudulent origination, map supplier file exchanges, and strip risky browser extensions before the next shift change.
Executive severity stack
Iranian affiliated PLC OT AA26-097A
Severity: Critical
Why leaders should care now: Confirmed disruptive impact on US water, energy, and government OT. The 22 July 2026 update expands vendor scope and IOCs across Rockwell Automation Allen Bradley, Schneider Electric, and Siemens families.
Langflow RCE
Severity: High
Why leaders should care now: Actively exploited AI agent framework under CISA prioritized federal remediation. Broad tool and API permissions make RCE a pivot risk into identity and data systems.
South Korea MFA Diplomatic Academy
Severity: High
Why leaders should care now: About 6,000 personnel records including about 350 overseas attachés. Delayed disclosure turns stolen identity and email data into global spear phish fuel.
Upbound Acima fraud
Severity: High
Why leaders should care now: Unauthorized data access converted into roughly 13 million USD Q2 fraud loss through fake lease to own agreements.
Stadler Rail Everest
Severity: High
Why leaders should care now: Roughly 12.3 million USD ransom demand after supplier shared platform breach. Rejection raises leak and secondary extortion risk.
Adobe Acrobat Chrome extension
Severity: Medium
Why leaders should care now: Unauthenticated path to WhatsApp Web conversation data via extension privilege in everyday browsing.
Iranian affiliated PLC sabotage Critical Water Energy Government
What happened
Iranian affiliated APT actors access misconfigured internet exposed PLCs from leased foreign VPS infrastructure. They pull project files with legitimate vendor tools Studio 5000, EcoStruxure Control Expert, and TIA Portal. They modify ladder logic and Add On Instructions, then push logic that can disable shutdowns and alarms while HMI SCADA views may still look normal to operators.
Why it is board level
This is architecture failure at nation state tempo, not a missing weekend patch. If a controller answers on the public internet, an overseas operator can become your programmer of record. Consulted sources confirm operational disruption and financial loss at some victim sites, with multi agency US government attribution and ongoing activity through the 22 July 2026 update.
Leader decision now
Name an executive owner for internet reachable PLC count by end of week. Demand a zero public OT admin face plan with dates. Fund jump hosts, MFA on every remote OT path, and logic baselining without waiting for a CVE string. Prioritize water, energy, and municipal government environments first.
Langflow RCE High Software AI Agent Platforms
What happened
Consulted reporting describes CISA ordering US government agencies to prioritize patching an actively exploited remote code execution flaw in Langflow, a visual framework used to build AI agents. Specific CVE string and full advisory body were not confirmed in all retrieved text for the wide search window; exploitation urgency still stands from the prioritization action.
Why it is board level
AI orchestration hosts often hold broad tool and API power. RCE there is a pivot into identity and data, not only a chat demo outage. Customer and partner AI pipelines may be in scope where Langflow is deployed in prod, dev, or vendor embedded form.
Leader decision now
Inventory every Langflow instance across business units and vendors. Internet facing means isolate or allowlist immediately. Rotate secrets and API keys the agents can touch. Review auth logs for anomalous agent or tool invocations. Bind exact CVE and build versions to primary advisory text before mass change windows.
South Korea MFA Diplomatic Academy High Government Diplomacy
What happened
Attackers held access to the National Diplomatic Academy online education system for about ten months beginning April 2025. They stole personal data of current and former MFA personnel including overseas diplomats. Public disclosure landed July 2026 after February 2026 discovery. Data types include IDs, names, email addresses, and encrypted passwords. Media also cite job titles and departments. MFA stated no unique national IDs, phone numbers, photos, or home addresses in the consulted disclosure path.
Why it is board level
Real diplomat names, titles, departments, and emails are premium fuel for spear phishing and influence operations against missions and partners worldwide. Delayed disclosure widens residual risk even if the original server foothold is closed.
Leader decision now
If your organization touches ROK diplomatic channels, raise email and identity monitoring. Verify unusual MFA themed requests out of band. Brief executives who travel or meet attachés. Treat any unexpected document or credential request that name drops real ROK personnel as hostile until proven otherwise.
Upbound Acima fraud High Financial Services Retail lease to own
What happened
Upbound Group disclosed unauthorized access to non sensitive customer information and documents. Attackers used that material to create fraudulent Acima lease to own agreements. Retailers were paid, goods were taken, leases were not honored, producing roughly 13 million USD Q2 Acima segment losses. No public ransomware claim was observed at publish time in consulted sources. Initial access method remains unconfirmed.
Why it is board level
Classic breach to first party fraud economics hit the income statement directly and invite scrutiny of origination authentication and document verification. Customer trust and regulatory attention follow the money loss.
Leader decision now
Validate step up authentication and document verification on high value origination flows. Review alert thresholds for velocity, repeated identity reuse, and document mismatch patterns. Align fraud, SOC, and customer ops on a single escalation path for suspected synthetic or stolen identity origination.
Stadler Rail Everest High Manufacturing Rail supply
What happened
Swiss rail manufacturer Stadler Rail rejected an approximately 12.3 million USD demand from the Everest ransomware brand after a breach involving a data exchange platform shared with a supplier. Independent nation state linkage is not confirmed in consulted sources. Full primary IR package detail was thin in the wide search pull; demand and rejection stand on consulted reporting.
Why it is board level
Supplier shared platforms concentrate engineering, commercial, and sometimes OT adjacent files. Non payment trades ransom cost for leak and secondary extortion risk across the supplier ecosystem.
Leader decision now
Map every third party file exchange. Confirm backup integrity and legal hold readiness. Exercise the we will not pay decision path with counsel before a leak clock starts. Require suppliers that share design or ops files to prove access logging and MFA on exchange platforms.
Adobe Acrobat Chrome extension Medium Browser Collaboration
What happened
Research coverage describes an Adobe Acrobat Chrome extension abuse path that could let sites access private WhatsApp Web conversations and data without authentication. Named mass exploitation campaign detail and CVE string were not confirmed in retrieved listing text.
Why it is board level
Confidential deal chat and executive messaging on WhatsApp Web become browser policy problems, not only mobile MDM problems. Extension over privilege turns routine browsing into a confidential chat disclosure path.
Leader decision now
Inventory browser extensions enterprise wide. Restrict or remove the Acrobat extension until vendor fix or safe version confirmation. Separate high risk collaboration apps from heavily extension loaded browser profiles where feasible.
Today decision order for CISOs and COOs
Count and disconnect internet exposed PLCs. Enforce OT remote access through MFA protected gateways and jump hosts.
Find and patch or isolate Langflow. Rotate agent secrets and review agent tool invocation logs.
Turn on heightened monitoring for ROK diplomatic spear phish and out of band verification.
Tighten lease to own and fintech origination fraud controls on step up auth and document checks.
Map supplier data exchange platforms and backup restore points. Pre brief counsel on extortion non payment posture.
Clean browser extension estates starting with Acrobat plus WhatsApp Web coexistence.
Schedule ATT&CK aligned OT detection tests against T0883, T0885, T1219, T1041, and T1565.
Intelligence quality note for executives
Critical OT judgments rest on a multi agency TLP CLEAR advisory with explicit IOCs and MITRE mappings. Several High portfolio items rely on consulted reporting that cites primary SEC, MFA, and CISA actions where full technical appendices were thin in one retrieval window. Act on isolation, inventory, and monitoring now. Bind irreversible patch and legal steps to primary documents as they are confirmed. Full report detail is best experienced on a wide desktop screen when published to the CMS.
Chapter 02 - Threat & Exposure Analysis
Identity and data theft converting into fraud or espionage follow on, edge and AI tooling exploitation, browser extension abuse, and nation state OT sabotage against internet exposed controllers. Not a single shared campaign. No shared actor or IOC overlap is confirmed across clusters in consulted sources. Two durable patterns still repeat: trusted platform compromise education portal, supplier exchange, AI agent framework, internet exposed PLC engineering ports and downstream monetization or coercion fraud, extortion, diplomat targeted phishing, process disruption.
Iranian affiliated multi vendor PLC access and safety logic override
Attack progression
Actors scan for publicly reachable PLCs and OT connected modems. They connect from attacker controlled leased VPS and foreign hosting infrastructure over EtherNet IP 44818, Rockwell messaging 2222, Siemens S7 Profinet 102, Modbus TCP 502, and SSH 22 on field modems. They run legitimate configuration software Studio 5000, EcoStruxure Control Expert, TIA Portal from cloud hosts. They download project files, modify ladder logic and Add On Instructions, then re upload altered logic. AOIs can override safety and shutdown pathways while downstream functions keep running. HMI SCADA displays can be manipulated so operators do not see unsafe conditions. Project files are exfiltrated over the same control path.
Exploitability
Root cause is misconfiguration and direct internet exposure, not a novel product CVE inside AA26-097A. Any PLC or modem that answers on the public internet with weak or default credentials or open engineering protocols is in class. Physical mode switches left unlocked on eligible Rockwell controllers increase remote modification risk. Historical Unitronics tradecraft from November 2023 onward default or absent passwords, custom ladder logic, exposed HMI PLC faces is continuous with the current multi vendor shift.
Campaign indicators
IOC IP association windows from January 2025 through July 2026. Confirmed disruptive victim activity from at least March 2026 across Government Services and Facilities, Water and Wastewater Systems, and Energy. Initial advisory 7 April 2026 focused on Rockwell Automation Allen Bradley. Update 22 July 2026 expands scope narrative to Schneider Electric and Siemens, adds IOCs, and deepens guidance on reusable modules and AOIs. Industry exposure mapping after initial publication showed large reachable Rockwell surfaces and scanning interest.
Threat actor
Iranian affiliated APT aligned with IRGC Cyber Electronic Command CEC. Overlapping labels in consulted material include CyberAv3ngers, Shahid Kaveh Group, Hydro Kitten, Storm 0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691. Attribution confidence High from multi agency US advisory.
Infrastructure fingerprinting
Leased VPS in non Iranian hosting environments. Foreign hosting providers as exit and engineering hosts. Dropbear SSH on victim modems. Vendor native engineering tools used as the attack platform. OT ports as C2 like channels. STIX packaged IOCs for bulk ingest.
Sector exposure
Water and Wastewater Systems, Energy, Government Services and Facilities including local municipalities. Municipal OT with legacy modem and remote vendor paths is structurally exposed.
Geographic exposure
Primary explicit evidence is United States critical infrastructure. Foreign infrastructure is not ruled out but is not confirmed as in scope by the same explicit advisory evidence. Actor infrastructure geography is deliberately overseas hosting, not a simple Iran geo tell.
MITRE
Explicit: T0883 Internet Accessible Device, T0885 Commonly Used Port, T1219 Remote Access Software, T1041 Exfiltration Over C2 Channel, T1565 Data Manipulation.
Inferred ICS aligned: default credentials, valid engineering accounts, modify parameter, manipulation of control, program download, automated collection, remote services.
Langflow actively exploited RCE CISA prioritization
Attack progression
Step by step exploit chain is insufficient in retrieved wide search text. Consulted sources state active exploitation and a CISA order for prioritized federal patching of an RCE in the Langflow visual framework used to build AI agents.
Exploitability
RCE class on an AI agent builder. Network reachable instances are high value. CVSS and CVE string not confirmed in retrieved full text. Assume internet facing or broadly reachable Langflow is urgent until primary advisory bind.
Campaign indicators
Insufficient in consulted sources beyond active exploitation status and federal prioritization language.
Threat actor
Under Attribution.
Infrastructure fingerprinting
Insufficient in consulted sources.
Sector exposure
Organizations running Langflow for AI agent workflows, including US federal agencies explicitly ordered to prioritize remediation. Vendor embedded or shadow IT deployments may be in scope.
Geographic exposure
US federal agencies explicit. Broader internet exposure not confirmed in retrieved text.
MITRE
No confirmed mapping in sources.
Inferred: T1190 Exploit Public Facing Application, T1059 Command and Scripting Interpreter post RCE, T1078 Valid Accounts if agent identities are abused, T1528 Steal Application Access Token for API keys and agent secrets, T1068 only if privilege boundaries are crossed not confirmed.
South Korea MFA National Diplomatic Academy education platform breach
Attack progression
Unknown actor exploited a vulnerability in the Academy server April 2025. Data exfiltrated April 2025 through February 2026. NIS discovery February 2026. Public disclosure July 2026. Compromised server reportedly inside MFA HQ and outside regular security scrutiny per media via consulted sources.
Exploitability
Server vulnerability stated. CVE ID not confirmed.
Data types
IDs, names, email addresses, encrypted passwords. Media also cite job titles and departments. MFA path states no unique national IDs, phone numbers, photos, or home addresses.
Threat actor
Under Attribution.
Infrastructure
Compromised education platform server in MFA environment per consulted reporting. No public IOC package in retrieved text.
Sector and geo
ROK MFA. About 6,000 current and former personnel. About 350 overseas attachés. Diplomats and partner orgs worldwide as secondary phishing targets.
MITRE
No confirmed mapping in sources.
Inferred: T1190 against education server, collection and exfiltration of identity data, T1589 Gather Victim Identity Information as outcome, T1566 Phishing as likely follow on not confirmed as already executed.
Upbound Group stolen customer data to Acima lease fraud
Attack progression
Unauthorized obtainment of non sensitive customer information and documents. Fraudulent lease to own agreements via Acima. Retailers paid. Merchandise taken. Lease payments not made. Roughly 13 million USD Acima segment Q2 loss.
Exploitability
Initial access method not confirmed.
Threat actor
Under Attribution. No ransomware or extortion claim observed at publish time.
Sector and geo
US fintech and lease to own Acima and Rent A Center brand context.
MITRE
No confirmed mapping in sources.
Inferred partial fit: credential or account abuse if portal access used not confirmed, T1657 Financial Theft as downstream impact, business logic fraud after data theft.
Stadler Rail Everest demand via supplier data exchange platform
Attack progression
Breach involving data exchange platform shared with a supplier. Everest ransom demand roughly 12.3 million USD. Company rejection.
Threat actor
Everest ransomware brand at claim level. Independent nation state linkage not confirmed.
Sector and geo
Swiss rail manufacturing and supplier ecosystem. Supplier shared platforms can concentrate engineering, commercial, and OT adjacent files.
MITRE
No confirmed mapping in sources.
Inferred: T1199 Trusted Relationship, exfiltration from collaboration platform, T1657 Financial Theft extortion, T1486 only if encryption detonation is later confirmed not detailed in consulted reporting.
Adobe Acrobat Chrome extension unauthenticated WhatsApp Web data access
Attack progression
Malicious or crafted site interaction with extension privileges. Access to WhatsApp Web rendered conversations and data without authentication.
Threat actor
Under Attribution. Vulnerability class reporting, not a named campaign in retrieved text.
MITRE
No confirmed mapping in sources.
Inferred: T1176 Browser Extensions, possible session material access depending on root cause not fully detailed.
Cross incident pattern analysis
Pattern one: trusted or exposed platform compromise PLC engineering face, Academy server, Langflow, supplier exchange, browser extension yields durable access, RCE, or confidential data.
Pattern two: downstream monetization or coercion fraud leases, ransom demand, diplomat phishing enablement, or OT process impact safety override and service disruption.
Defender implication: close internet faces and trusted third party paths first, then hunt secondary fraud and phishing that monetize stolen context.
Chapter 03 - Operational Response
Posture
Patch or isolate AI agent tooling under active exploit claims in parallel with OT internet exposure kill actions. Run identity fraud and diplomatic phishing hardening in the same shift window. Review third party file exchanges. Control browser extensions. OT actions are Critical path. Langflow is High urgency emergency inventory. Other clusters are High parallel tracks.
Iranian affiliated PLC immediate response and containment
Do this now
Disconnect PLCs from direct internet exposure. Remove public DNAT, cloud VIP, and modem port forwards that publish engineering protocols. Place remote access only through approved jump hosts or secure gateways with MFA. For Rockwell devices with physical mode switches, verify project files and AOIs against known good baselines, then lock controllers into RUN to block remote ladder logic modification where that control applies. Enable equivalent programming protection modes on Siemens and Schneider fleets per vendor guidance.
Do this within 24 hours
Ingest AA26-097A STIX XML JSON packages. Query firewall, VPN, OT historian, and engineering workstation logs for advisory IOC IPs across January 2025 through July 2026 association windows, with priority on March 2026 onward disruptive window. Hunt destination ports 44818, 2222, 102, 502, and 22 toward assets tagged PLC, HMI, or ICS modem from foreign hosting sources. Snapshot configuration and project file hashes before remediation rebuilds if compromise is suspected. Rotate credentials on exposed engineering accounts and modem admin faces.
Do this within 72 hours
Complete full internet exposure sweep with external attack surface tools and vendor approved queries. Validate every remote OT path for MFA and least privilege. Stand up or restore known good ladder logic and AOI libraries. Brief plant managers on HMI distrust protocol if process values and alarms disagree with field reality. Open executive incident channel for any confirmed project file upload from non approved identity or IOC IP.
Security hardening actions
Move all PLC admin faces behind mediated access. Eliminate default credentials. Segment IT OT and remote vendor zones. Monitor configuration integrity continuously. Prefer secure by design procurement so new controllers do not ship with internet reachable admin defaults.
Internal security coordination
Notify OT engineering, SOC, IR, plant operations, CISO, and critical infrastructure compliance owners. Escalate immediately on confirmed logic change, unexplained controller stop or degraded process, or IOC IP hitting OT ports.
Langflow immediate response and containment
Do this now
Asset inventory every Langflow instance prod, dev, lab, vendor hosted, container, and VM. If internet facing, restrict to VPN allowlist or take offline until patched.
Do this within 24 hours
Apply vendor and CISA directed patches after primary advisory bind for exact version strings. Rotate secrets, API keys, and tokens accessible to Langflow agents. Review auth and tool invocation logs for anomalous agent behavior. Snapshot volatile logs before rebuild if compromise suspected.
Security hardening actions
Network segment AI orchestration hosts. Deny default egress except approved model and API endpoints. Enforce MFA and least privilege on any identity Langflow can assume. Treat agent tool permissions as production admin power.
Internal security coordination
Notify vuln management, cloud platform engineering, AI ML platform owners, and CISO. Escalate on unexplained process spawn, odd outbound API use, or credential use from agent hosts outside baseline.
Response steps that require vendor advisory confirmation before execution remain gated on exact CVE, fixed builds, and official IOCs.
South Korea MFA diplomatic residual risk response
Do this now
If your org interacts with ROK diplomatic channels, raise mail gateway and identity monitoring sensitivity for MFA themed lures, attaché name drops, and urgent document requests.
Do this within 24 hours
Publish out of band verification SOP for any request that cites real ROK personnel titles or departments. Brief VIPs and travel teams. Watch for lookalike domains and freshly registered sender infrastructure using diplomatic motifs.
Hardening
DMARC enforcement where you control domains. External sender banners. Heightened scrutiny on OAuth consent and MFA fatigue style prompts after diplomatic engagement spikes.
Coordination
Notify SOC detection engineering, IR, executive protection, and corporate communications if public liaison teams are in scope.
Upbound Acima style fraud response for fintech and lease to own
Do this now
Review origination queues for velocity spikes, repeated identity elements, and document reuse patterns tied to the disclosure window.
Do this within 24 hours
Enforce step up authentication on high value lease to own origination. Strengthen document verification and liveness checks. Align fraud ops with SOC on a joint escalation path. Prepare customer messaging consistent with SEC disclosure facts only.
Hardening
Risk based authentication, device intelligence, entity link analysis across applications, delayed fulfillment holds on high risk scores.
Coordination
Notify fraud, appsec, customer operations, legal, and finance controllers given quantified loss impact.
Stadler style supplier platform extortion response
Do this now
Inventory all supplier shared data exchange platforms, managed file transfer tools, and vendor portals that hold engineering or commercial packages.
Do this within 24 hours
Confirm MFA, logging, and DLP on those platforms. Verify backup integrity and offline restore points. Place legal hold if breach of shared platforms is suspected. Pre brief leadership and counsel on non payment posture and leak response.
Hardening
Least privilege partner accounts, time boxed shares, watermarking, anomaly alerts on bulk download, contractual IR notification SLAs.
Coordination
Notify TPRM, legal, IR, manufacturing IT OT, and corporate communications.
Adobe Acrobat Chrome extension response
Do this now
Enterprise browser extension inventory. Identify Acrobat extension presence alongside WhatsApp Web usage.
Do this within 24 hours
Restrict or remove the extension via browser management until vendor fix or safe version confirmation. Separate high sensitivity chat usage from extension heavy profiles where feasible.
Hardening
Allowlist extensions. Block sideload. Continuous extension posture assessment.
Coordination
Notify endpoint engineering, desktop engineering, and data protection.
November 2023 onward
IRGC affiliated actors CyberAv3ngers and aliases compromise at least 75 Unitronics PLC HMI devices across multiple sectors. Custom ladder logic deployed for disruptive effects. Default or absent passwords and internet exposure including historical TCP 20256 patterns appear in historical advisory context AA23-335A.
January 2025 through March 2026
Multiple IPs including 185.82.73.x range examples associate with Iranian affiliated APT activity against internet exposed PLCs per AA26-097A historical IOC tables.
April 2025
South Korea National Diplomatic Academy online education system intrusion begins per MFA disclosure path in consulted reporting.
April 2025 through February 2026
Academy related data exfiltration window for current and former MFA personnel data including overseas diplomats.
January 2025 through July 2026
Broader AA26-097A actor IP association windows spanning leased foreign infrastructure used to reach victim PLCs.
March 2026
Authoring agencies identify Iranian affiliated APT group disrupting PLC functions across US Government Services and Facilities, Water and Wastewater Systems, and Energy. Some victims experience operational disruption and financial loss.
February 2026
NIS discovers the National Diplomatic Academy compromise.
7 April 2026
AA26-097A initial publication. Warns of active exploitation against Rockwell Automation Allen Bradley PLCs. Provides mitigations, IOCs, and MITRE mappings.
April through May 2026
Industry researchers map exposed Rockwell PLC surface and document scanning and exploitation interest referencing AA26-097A.
Q2 2026
Upbound Acima segment suffers roughly 13 million USD losses from fraudulent lease to own agreements downstream of unauthorized access to customer information and documents, per SEC disclosure path timing in consulted reporting.
22 July 2026
AA26-097A update expands targeting scope narrative to Schneider Electric and Siemens PLCs. Adds new IOCs and detailed guidance on detecting malicious changes in reusable code modules and AOIs.
Operator use of the timeline
OT log queries must cover January 2025 through July 2026 for IOC IPs, not only post April advisory dates. Diplomatic phishing defense should assume possible abuse of stolen MFA data anytime after April 2025 exfiltration start, with residual risk elevated after July 2026 disclosure. Langflow, Upbound, Stadler, and Adobe actions anchor on the 22 July 2026 disclosure window while primary technical appendices continue to bind.
Chapter 04 - Detection Intelligence
Iranian affiliated PLC technical deep dive
Core technique
Abuse of internet exposed PLC engineering ports from attacker controlled VPS infrastructure using vendor native tools. No requirement for a zero day in the advisory core narrative. Reachability plus weak architecture equals remote programmer privileges.
Access path detail
Actors target:
44818 EtherNet IP Rockwell
2222 Rockwell messaging
102 Siemens S7 Profinet ISO
502 Modbus TCP
22 SSH on field modems often with Dropbear
Once connected they use Studio 5000, EcoStruxure Control Expert, or TIA Portal style workflows to:
pull project files
inspect safety and shutdown logic
modify ladder logic and Add On Instructions
push altered programs to controllers
optionally manipulate HMI SCADA presentation layers
Safety override pattern
AOIs and logic changes disable or bypass critical shutdown and alarm pathways while leaving enough downstream logic intact that processes can appear healthy. That combination produces covert process risk and overt service disruption. Operators who trust HMI only can miss the real state.
Exfiltration pattern
Project files leave the environment over the engineering control channel to third party hosted infrastructure. Stolen projects are both intelligence about the process and templates for precise malicious edits.
Why vulnerability scanners under detect this
AA26-097A is primarily an architecture and governance failure class. Internet accessible device plus commonly used OT ports plus remote access on modems plus data manipulation. Detection hinges on exposure management, segmentation, engineering workstation control, configuration integrity, and identity of who is allowed to program controllers.
Explicit ATT&CK backbone
T0883 Initial Access internet accessible device
T0885 C2 commonly used OT ports
T1219 C2 remote access software on modems
T1041 Exfiltration over C2 channel project files
T1565 Impact data manipulation logic and HMI
Inferred ICS technical behaviors for hunts
Default credential residual risk on legacy HMI PLC faces
Valid engineering account abuse once the face is reachable
Program download of malicious logic
Modify parameter of trip alarm and shutdown enables
Automated collection of project corpora from many sites
Langflow technical notes
RCE on an AI agent builder framework. Technical exploit primitive, CVE, and CVSS not confirmed in retrieved wide search text. Strategic technical risk is post exploit use of agent tool routers, connected APIs, vector stores, and cloud identities. Hunt anomalous tool invocation, unexpected outbound model or SaaS API calls, and secret use outside baseline. Exact detection signatures wait for primary advisory artifacts.
South Korea MFA Academy technical notes
Server vulnerability exploited on an online education system. CVE not confirmed. Multi month dwell implies weak detection on a system outside regular security scrutiny per consulted media path. Stolen corpus is identity rich names, emails, encrypted passwords, titles, departments. Technical follow on risk is highly personalized phishing and possible password reuse spraying where encrypted passwords are later cracked. No public malware family named in consulted text.
Upbound Acima technical notes
Initial access path not confirmed. Confirmed technical business outcome is abuse of customer information and documents to pass lease to own origination controls. Detection gravity sits in application fraud telemetry more than classic EDR IOC hits: document forensics, entity linking, device reputation, velocity, and fulfillment anomalies.
Stadler Everest technical notes
Breach locus is a data exchange platform shared with a supplier. That implies trusted relationship access, bulk file collection, and extortion staging. Payload encryption detail not confirmed in consulted reporting. Technical priority is platform access logs, partner account misuse, bulk download alerts, and integrity of engineering file repositories.
Adobe extension technical notes
Browser extension privilege boundary failure relative to WhatsApp Web session content. Technical control is extension allowlisting, reduced permission extensions, and isolating WhatsApp Web from high privilege browsing profiles. Root cause CVE not confirmed in retrieved listing.
Detection engineering implications across portfolio
OT: network plus config integrity plus engineering identity
AI tooling: inventory plus egress plus secret hygiene
Diplomacy: identity centric mail and web auth monitoring
Fintech: fraud decisioning telemetry
Manufacturing TPRM: file exchange platforms
Enterprise: browser extension posture
OT cluster network IOCs from AA26-097A
20 plus IP addresses across advisory tables with actor association dates from January 2025 through July 2026. Examples carried in consulted deep research merge include:
185.82.73.175
141.11.164.153
175.110.121.42
175.110.121.39
175.110.121.41
175.110.121.107
192.142.54.79
84.200.205.165
185.225.17.225
79.133.46.209
88.80.150.199
88.80.150.200
88.80.150.202
Historical set examples: 185.82.73.162, 185.82.73.164, 185.82.73.165, 185.82.73.167, 185.82.73.168, 185.82.73.170, 185.82.73.171, 135.136.1.133
Ingest authoritative values from the official advisory PDF and STIX packages rather than retyping from chat. Vet before hard blocks because cloud hosting IPs can be reallocated.
OT ports and service indicators
44818 EtherNet IP Rockwell
2222 Rockwell messaging
102 Siemens S7 Profinet
502 Modbus TCP
22 SSH on ICS modems
Dropbear process on modem class hosts
Unexpected project file upload events on PLC role devices
Engineering tool sessions Studio 5000, EcoStruxure Control Expert, TIA Portal sourced from non approved jump hosts or from IOC IPs
OT file and logic artifacts
Modified ladder logic
Malicious or unexpected Add On Instructions overriding safe shutdown and alarm enables
Malformed project files
HMI SCADA values that disagree with field instrumentation after remote engineering sessions
Additional project file hashes and integrity markers distributed via STIX XML JSON packages referenced by the advisory
OT infrastructure pattern
Actors lease VPS capacity in foreign hosting environments, install or use vendor engineering software there, and operate entirely remote with no physical presence at victim plants. Modem SSH extends reach into OT zones that appear “only serial or field connected” on architecture diagrams but still have out of band connectivity.
Enrichment guidance for OT IOCs
Join src IP to geo ASN and hosting org
Join dest IP to CMDB role PLC HMI modem engineering workstation
Join timestamps to change windows and manned OT shifts
Join user identities to approved OT engineer and vendor lists
Join config diffs to known good baselines
Prefer alert severity critical when IOC IP plus OT port plus PLC role plus non approved identity coincide
Wide search clusters IOC status
Langflow: 0 recoverable IOCs in retrieved text. Pending CVE, version, hash, and URL package from primary CISA vendor advisories.
South Korea MFA: 0 recoverable network IOCs in retrieved text. Pending government indicator release. Practical watch items are phishing lures abusing real personnel names titles emails.
Upbound Acima: 0 recoverable intrusion IOCs in retrieved text. Practical indicators are fraud telemetry features not classic IP hash lists.
Stadler Everest: 0 recoverable payload or C2 IOCs in retrieved text. Pending IR and any public claim package analysis through approved intel processes.
Adobe extension: 0 exploit sample hashes in retrieved text. Practical indicator is extension ID and version inventory until vendor bulletin bind.
Infrastructure priorities if you can only do five things in IOC ops today
Import AA26-097A STIX and enable IP plus port detections.
Tag OT asset roles in SIEM CMDB or detections will not fire correctly.
Build allowlist of approved engineering jump hosts before mass blocking foreign ASN space.
Stand known good project file hash library for Rockwell Schneider Siemens fleets in scope.
Open pending enrichment tickets for Langflow CVE bind, ROK phishing follow ons, Everest package, and Adobe fixed version rather than inventing IOCs.
Safety note on indicator handling
Public social and chat channels should not dump full live IOC tables beyond what public TLP CLEAR PDFs already publish when avoidable. SOC and OT engineering should pull from the advisory packages directly. Always vet shared hosting IPs before permanent deny lists to limit self inflicted outages on unrelated cloud tenants.
Detection posture for this daily record is OT first. AA26-097A gives enough behavioral detail to ship network, host, and configuration integrity detections now. Langflow, diplomatic phishing, lease fraud, supplier exchange extortion, and browser extension abuse need inventory and telemetry hunts until primary IOC packages bind. Below content is detection oriented and mapped to behaviors in consulted sources. Tune ASNs, countries, allowlists, and identity directories before production enforce mode.
SIGMA style network rule OT protocol access from foreign hosting
This models OT protocol access from foreign VPS infrastructure to devices labeled PLC, HMI, or modem using the AA26-097A port set. Country and ASN values are placeholders. Consulted advisory text stresses foreign hosting providers without publishing an exhaustive ASN list. Populate from your threat intel enrichment on the advisory IP tables. Always allowlist approved jump hosts and vendor PSIRT paths.
SIGMA style auth config rule Dropbear SSH on OT modem
Dropbear on production OT modems is high signal. AA26-097A calls out modem SSH on port 22 as a remote access mechanism.
YARA style project file integrity rule malicious AOI patterns
Illustrative only. AA26-097A does not publish precise ladder logic opcodes. Adapt after you normalize Rockwell ACD and related project exports into searchable intermediate form.
Use known good AOI catalogs as the real production control. String examples teach analysts what class of override to seek. Replace with site specific safety AOI names and instruction patterns from your baselines.
SIEM correlation unsafe PLC project file changes
Populate IOC_IP_LIST_AA26_097A from advisory tables and STIX packages. Add a daytime twin rule without the time gate at medium severity for unexpected identities even during business hours.
SIEM correlation OT port hit plus foreign hosting plus PLC role
SIEM hunt Langflow pending CVE bind
Exact version and CVE gates remain blocked on primary advisory text.
SIEM hunt diplomatic spear phish residual risk
SIEM hunt lease to own fraud origination
SIEM hunt supplier file exchange bulk theft
Browser extension posture check
SOC implementation order
Ingest AA26-097A STIX and enable IP port correlation.
Deploy Dropbear modem critical rule.
Wire project file upload correlation to approved identity lists.
Tag CMDB roles PLC HMI modem jump host engineering workstation or OT rules stay blind.
Open Langflow inventory dashboard the same day.
Turn on diplomatic spear phish and fraud origination hunts as medium high content while IOC poor.
Extension allowlist audit via browser management, not only SIEM.
False positive control
Approved OEM remote engineering must traverse named jump hosts with MFA tickets. Without that allowlist, foreign ASN logic will page on legitimate vendor work. OT detections should page a joint SOC plus controls engineer on call, not only IT SOC alone.
Explicit ATT&CK techniques from AA26-097A
T0883 Internet Accessible Device
Tactic Initial Access
Behavioral basis: actors connect to misconfigured publicly exposed PLCs and related OT devices.
T0885 Commonly Used Port
Tactic Command and Control
Behavioral basis: OT protocol ports 44818, 2222, 102, 502 used as control paths that blend with legitimate engineering traffic.
T1219 Remote Access Software
Tactic Command and Control
Behavioral basis: Dropbear SSH on victim modems over port 22.
T1041 Exfiltration Over C2 Channel
Tactic Exfiltration
Behavioral basis: PLC project files leave via third party hosted infrastructure and attacker engineering sessions.
T1565 Data Manipulation
Tactic Impact
Behavioral basis: ladder logic and AOI modification, plus HMI SCADA tampering that can hide unsafe states.
Explicit tactics from AA26-097A
Initial Access
Command and Control
Exfiltration
Impact
Inferred MITRE components for OT depth label inferred for hunts and purple team only
T0812 Default Credentials inferred ICS
T0859 Valid Accounts inferred ICS
T0836 Modify Parameter inferred ICS
T0831 Manipulation of Control inferred ICS
T0802 Automated Collection inferred ICS
T0843 Program Download inferred ICS
T0886 Remote Services inferred ICS
Inferred techniques for wide search clusters no official IDs in consulted text
Langflow
T1190 Exploit Public Facing Application inferred
T1059 Command and Scripting Interpreter inferred
T1078 Valid Accounts inferred
T1528 Steal Application Access Token inferred
South Korea MFA Academy
T1190 Exploit Public Facing Application inferred
T1589 Gather Victim Identity Information inferred
T1041 or T1048 style exfiltration inferred without channel detail
T1566 Phishing inferred as follow on risk not confirmed executed
Upbound Acima
T1657 Financial Theft inferred downstream
account or document abuse path partial ATT&CK fit not confirmed for initial access
Stadler Everest
T1199 Trusted Relationship inferred
exfiltration from collaboration platform inferred
T1657 Financial Theft inferred extortion
T1486 Data Encrypted for Impact inferred only if detonation is later confirmed
Adobe Acrobat Chrome extension
T1176 Browser Extensions inferred
possible session material access inferred depending on root cause detail not fully present in retrieved text
D3FEND oriented defensive mapping derived from mitigation guidance not claimed as native advisory IDs
Network segmentation and mediation for OT
Keeps engineering protocols off the public internet and away from flat IT networks.
Remote access protection
Jump hosts, secure gateways, MFA on every OT remote path, no direct modem admin face on the public internet.
Credential hardening
Remove defaults, rotate exposed engineering and modem credentials, least privilege vendor accounts.
Configuration monitoring
Known good ladder logic and AOI baselines, alert on project upload and safety routine diffs.
Inventory isolation for AI tooling
Langflow asset inventory, egress allowlists, secret rotation, segment agent hosts.
Browser extension hardening
Allowlists, removal of over privileged Acrobat extension until fixed version confirmation.
Third party relationship control
Supplier file exchange MFA, logging, bulk download alerts, contractual IR SLAs.
Identity phishing resilience
Out of band verification for diplomatic name drop lures built from stolen MFA corpora.
ATT&CK validation priority order for this week
Prove detections for T0883 T0885 T1219 T1041 T1565 in a lab PLC or digital twin.
Prove program download and modify parameter hunts on engineering workstations.
Prove Langflow internet face inventory and secret rotation drill.
Prove supplier exchange bulk download alert.
Prove extension allowlist enforcement on a pilot OU.
Prove diplomatic spear phish report path from mailbox to IR.
Mapping rule for analysts
Use explicit AA26-097A techniques in executive and compliance language. Keep inferred techniques in detection backlogs and purple team scripts with the inferred label visible so GRC does not treat them as court grade attribution artifacts.
Chapter 05 - Governance, Risk & Compliance
Governance failure statement for the Critical OT incident
PLC exploitation in AA26-097A is primarily a consequence of governance and architectural choices: exposing controllers to the public internet, relying on default or weak credentials, and lacking enforced segmentation among IT, OT, and remote access paths. Consulted multi agency guidance treats internet exposure decisions as board level risk choices, not only plant IT tickets. Align programs to CISA Cross Sector Cybersecurity Performance Goals themes including MFA, network segmentation, and secure by design product selection.
Board level risk register entries to open or update this week
OT internet exposure residual risk
Impact: process disruption, safety pathway disablement, environmental and service consequences in water and energy, municipal service loss, financial loss already observed at some victims.
Likelihood: elevated while any PLC HMI modem engineering face remains publicly reachable.
Owner: COO plus CISO joint, with named OT engineering deputy.
Treatment: eliminate public OT admin faces, MFA mediated remote access, logic integrity program, quarterly external attack surface attestation.
AI agent framework RCE residual risk
Impact: RCE on hosts that often hold broad tool and API power, pivot into identity and data, regulatory exposure for federal and contractor environments under prioritized remediation expectations.
Owner: CISO plus head of AI or platform engineering.
Treatment: inventory, isolate internet faces, patch after primary advisory bind, secret rotation, segment agent egress.
Diplomatic identity corpus residual risk
Impact: spear phishing and influence operations against staff who interact with ROK missions, executive fraud, wire fraud attempts using real attaché context.
Owner: CISO plus head of corporate security and international affairs liaison.
Treatment: heightened monitoring, out of band verification SOP, VIP briefing, report metrics weekly for 90 days post disclosure.
First party fraud residual risk fintech lease to own
Impact: direct income statement loss demonstrated near 13 million USD Q2 in the Acima segment narrative, customer trust harm, possible regulatory scrutiny of origination controls.
Owner: chief risk officer plus fraud leader and CISO.
Treatment: step up auth, document verification, velocity controls, joint fraud SOC escalations, post incident control effectiveness review.
Supplier platform extortion residual risk
Impact: engineering and commercial data leak, secondary extortion, manufacturing delay, contractual liability across supplier ecosystem.
Owner: chief legal officer plus TPRM and manufacturing IT.
Treatment: platform inventory, MFA and logging standards, backup restore tests, pre decision non payment playbook, supplier IR notification SLAs.
Browser confidential chat residual risk
Impact: disclosure of WhatsApp Web conversations through extension privilege, privacy and deal confidentiality harm.
Owner: CISO plus desktop engineering.
Treatment: extension allowlist, remove or restrict Acrobat extension until safe version, profile separation for sensitive chat.
Vendor and procurement governance
Manufacturers should ship PLCs with secure default postures, avoid exposing administrative interfaces directly to the internet by default, and support MFA and modern secure remote access without punitive licensing. Procurement language should require:
default deny remote engineering faces
credential management that is not default forever
integrity checking support for ladder logic and project files
SBOMs and secure update paths for AI agent frameworks
extension permission minimization for enterprise browser add ons
contractual breach notification timelines for supplier file exchanges
Regulatory and assurance angles
Critical infrastructure operators should map AA26-097A actions to existing OT cyber programs, incident reporting duties, and sector regulators for water energy and government facilities. Federal entities and contractors should track Langflow prioritization language against BOD style and KEV style obligations once CVE binds. Public companies should keep fraud and cyber disclosure language consistent with SEC filings when losses are material. International firms interacting with ROK diplomatic channels should document residual phishing risk treatment after the delayed Academy disclosure.
Risk acceptance that is no longer reasonable
Accepting direct internet exposure of PLC engineering protocols as a temporary convenience is not a defensible long term acceptance under current consulted government guidance. Temporary acceptance, if unavoidable for a bare metal constraint, needs compensating controls: allowlist source IPs, short time box, heightened monitoring, executive signature, and a dated removal plan.
KRIs and KPIs leadership should see weekly
Count of internet reachable PLC HMI modem faces, target zero
Percent OT remote sessions via MFA jump host, target 100
Percent controllers with verified known good logic baseline, climbing weekly
Langflow instance inventory completeness and patch state
Diplomatic spear phish report volume and click rate
Lease origination fraud hold rate and confirmed fraud loss
Supplier exchange platforms with MFA logging DLP evidence
Browser extension compliance rate on Acrobat policy
Chapter 06 - Adversary Emulation
Emulation goal
Validate people, process, and technology against the behaviors that matter this week, especially AA26-097A OT techniques, without endangering live physical processes. Use lab PLCs, digital twins, mirrored engineering software, and offline project files for destructive logic tests. Use production only for passive detection validation and non destructive exposure checks.
OT purple team scenario pack explicit techniques
Scenario OT1 Internet accessible device discovery T0883
Red: from an external vantage, enumerate reachable hosts on 44818, 2222, 102, 502, 22 against a lab OT range that mirrors production exposure mistakes.
Blue: confirm external ASM and SOC alerts fire within agreed minutes, including asset role tags.
Pass: alert names the asset role and port, pages joint OT on call, zero silent misses on intentional lab exposures.
Scenario OT2 Common OT port control path T0885
Red: open engineering sessions from a foreign hosting like VPS to lab PLCs over the advisory port set.
Blue: firewall SIEM correlation catches non jump host sources.
Pass: high severity alert, jump host allowlist bypass verified, no production dependency.
Scenario OT3 Modem remote access T1219
Red: deploy Dropbear on a lab ICS modem image and accept SSH on 22.
Blue: host rule critical alert on process name plus host role.
Pass: critical page, modem isolated by runbook within target time.
Scenario OT4 Project file theft T1041
Red: download project files via vendor engineering tool from lab cloud engineer host.
Blue: detect bulk project read plus egress to unapproved cloud destination.
Pass: exfil alert before full corpus leaves, ticket links to AA26-097A runbook.
Scenario OT5 Malicious AOI and logic impact T1565 plus inferred program download modify parameter
Red: in lab only, insert AOI or logic that disables a simulated shutdown or alarm enable while leaving downstream simulation green. Optionally alter HMI tags so operator screen disagrees with simulated field sensors.
Blue: configuration integrity diff catches change, operators execute HMI distrust protocol.
Pass: change caught pre or immediately post download, rollback to known good succeeds, safety officer signs validation notes.
Scenario OT6 End to end advisory path
Red: chain OT1 through OT5 using IOC IPs from a lab sinkhole list that mirrors advisory table structure.
Blue: execute full IR from detect contain eradicate recover, including RUN mode lock where applicable after verify.
Pass: measured MTTD MTTR, executive notification quality, evidence handling suitable for regulator questions.
ATT&CK six step validation loop recommended in advisory spirit
Select techniques T0883 T0885 T1219 T1041 T1565 first.
Align security technologies firewall DNS EDR OT IDS SIEM config integrity.
Test controls in lab twin.
Analyze misses and noisy false positives.
Iterate rules allowlists and runbooks.
Continuously tune people process tools on a fixed cadence monthly for OT while this campaign remains Active.
Langflow emulation pending CVE bind
Do not run weaponized public exploits against production.
Safe tests now:
inventory completeness drill find all instances within time box
internet face check via approved ASM
secret sprawl review on agent hosts
egress allowlist fail test in lab
tabletop RCE to cloud token theft to data store access
When primary advisory publishes fixed versions, add patch latency test and regression of agent workflows.
Diplomatic phishing emulation
Build internal tabletop and closed red mail templates that use fake but realistic diplomatic context without reusing real stolen personal data from the breach corpus.
Measure report rate, click rate, time to revoke sessions, and VIP out of band verification compliance.
Fintech fraud emulation
Simulate stolen document powered lease applications in a lower environment.
Validate step up auth challenges, document forensic holds, entity link graph alerts, and fulfillment delay controls.
Success is fraud stopped pre funding and pre merchandise release.
Supplier exchange extortion tabletop
Walk leadership through: detect bulk download, legal hold, customer supplier notification thresholds, backup restore proof, public leak clock, pay versus not pay decision with counsel, communications draft.
Technical inject: partner account anomalous bulk read on a staging exchange.
Browser extension abuse test
On a lab browser profile with WhatsApp Web test accounts only, validate whether current Acrobat extension versions still create the disclosure class issue after vendor updates.
Confirm enterprise policy can block the extension and prove compliance telemetry.
Emulation safety rules
Never modify ladder logic on live safety instrumented systems for testing.
Never use production modem credentials in red scripts.
Never exfil real plant projects to personal cloud.
Never run unvetted ransomware samples to “emulate Everest.”
Document every test with change window, rollback, and safety officer approval where process simulation can still affect people or environment.
Evidence to store from tests
Alert IDs, screenshots, SIEM query IDs, time stamps, missed detection list, remediation owners, retest dates. Feed failures into Field Confidence and detection backlog, not into silent slideware.
FIELD 35 CONFIDENCE RATIONALE
Portfolio confidence score remains 78 out of 100 for the combined daily record. Per cluster scores remain 90 OT, 55 Langflow, 62 ROK MFA, 68 Upbound Acima, 52 Stadler Everest, 45 Adobe extension.
Rationale in concise structured form without a grid table
Highest authority backbone
Multi agency AA26-097A from FBI, CISA, NSA, EPA, DOE, US Cyber Command CNMF, and Treasury, including the 22 July 2026 update, anchors Critical OT findings near 90.
Historical tradecraft corroboration
AA23-335A Unitronics focused IRGC affiliated PLC campaign continuity strengthens actor and TTP confidence without replacing current IOC tables.
Secondary OT corroboration
Industry exposure analyses and practitioner commentary align on internet exposed PLC risk and do not contradict the advisory technical core.
Langflow evidence gap
Active exploitation urgency is relayed through consulted reporting of CISA prioritization. Full advisory body, CVE, CVSS, and IOC package were not retrieved in the wide search pull. Score capped near mid 50s.
ROK MFA breach fact pattern
Government disclosure path via consulted reporting supports medium confidence on dwell, counts, and data types. Actor and initial CVE remain unstated.
Upbound fraud quanta
SEC disclosure path supports medium to elevated confidence on mechanism and roughly 13 million USD Q2 Acima loss. Actor remains unattributed.
Stadler Everest
Secondary reporting of demand and rejection without an independent full IR package in the pull keeps score near low 50s.
Adobe extension
Research coverage without deep root cause CVE bind in retrieved text keeps score mid 40s.
IOC completeness
Strong for OT with 20 plus IPs, ports, and STIX path. Zero recovered classic IOCs for non OT clusters pull the portfolio average down from the OT peak.
MITRE completeness
Explicit mappings only for the OT cluster. Other clusters rely on inferred techniques that stay labeled inferred.
Conflict check
No credible authoritative source in the merge disputes Iranian affiliated OT attribution or the Acima loss disclosure core.
Portfolio weighting method
Impact weighted composite, not a simple mean. OT Critical mass plus multi agency authority anchors 78 rather than the sub 60 draft that reflected wide search only.
Residual uncertainty
Global PLC targeting beyond US focused evidence, exact ladder opcodes, Langflow CVE string, MFA initial CVE, Everest claim package depth, Adobe fixed version.
Floor and cap
No secondary only attribution claim was inflated to High. OT remains capped at 90 because of incomplete global scope detail and unpublished full logic opcode content.
How consumers should use the score
Act on AA26-097A isolation, MFA, OT port monitoring, and project integrity with near authoritative confidence.
Treat Langflow inventory, ROK phishing hardening, and Acima origination controls as directionally mandatory while binding patches and legal notice language to primary documents.
Track Stadler style supplier extortion for TPRM without over claiming unshared IR detail.
Tighten extension policy on medium confidence pending vendor bulletin bind.
Store 78 in CMS Confidence Score and keep this per cluster breakdown beside it for auditors and SOC leads.
Iranian affiliated PLC OT AA26 097A: 90/100
Langflow CISA prioritized RCE: 55/100
South Korea MFA National Diplomatic Academy: 62/100
Upbound Group Acima fraud wave: 68/100
Stadler Rail Everest demand: 52/100
Adobe Acrobat Chrome extension WhatsApp Web: 45/100