Weekly U.S. Critical Infrastructure Threat Brief (2026-04-01 to 2026-04-07)

During 2026-04-01 → 2026-04-07, authoritative agency advisories converged on two urgent themes: (1) Iranian-affiliated actors exploiting internet-exposed PLCs with TTPs that include Dropbear SSH and project-file extraction; and (2) a CISA Known Exploited Vulnerabilities (KEV) addition (CVE-2026-35616) for Fortinet FortiClient EMS requiring mandatory remediation under BOD 22-01 for federal agencies.

→ Both items materially increase near-term operational risk to owners/operators of OT and widely deployed vendor products.

• Advisory-provided IPs (135.136.1[.]133 and 185.82.73[.]162–185.82.73[.]171) usable for telemetry correlation — investigative correlation required before blocking.
• KEV additions and BOD 22-01 remediation introduce cross-sector operational risk during coordinated patching windows.
• No new major telecom-vendor CVEs (Ericsson, Nokia, Cisco, Huawei) identified in-window; continued monitoring required.
• No authoritative reports showed large-scale BES impacts from PLC exploitation; impacts localized to water and other OT owners.

Victim counts and scale of PLC intrusions remain unverified. Telemetry enrichment (netflow, firewall, VPN, EDR) and vendor PSIRT/CSIRT disclosures are required to strengthen confidence.

VULNERABILITY ASSESSMENT

⚠ INDICATORS OF COMPROMISE (DEFANGED)

No validated malicious file hashes were published in-window by authoritative sources for U.S. incidents.

Telecommunications

Key point: No confirmed U.S. telecom incidents in-window. Salt Typhoon and other China-nexus campaigns remain relevant but were not observed in the 7-day period.

Recommendation: Continue CVE monitoring for major vendors; plan coordinated remediation windows where Fortinet or other vendor updates are required.

Energy (OT/ICS Focus)

Key point: Joint Federal Advisory AA26-097A is actionable — internet-exposed Rockwell PLCs were exploited, enabling project-file exfiltration and HMI/SCADA manipulation.

Immediate Actions: Inventory internet-accessible PLCs, block direct internet access or place behind authenticated jump hosts, validate backups and physical mode switches, hunt logs for Dropbear SSH and advisory IPs.

Transportation

Key point: Transportation systems identified as affected by Schneider EcoStruxure (CVE-2024-2658). No confirmed U.S. cyber-physical incidents in-window.

Recommendation: Apply vendor mitigations for CVE-2024-2658 and perform integrity checks on affected OT components.

Cross-Sector Cascading Risk

Shared exposure: Internet-exposed PLCs and widely deployed vendor management products are a cross-sector risk vector. Actor techniques (Dropbear SSH, remote engineering tool misuse, project-file extraction) are consistent across Energy, Water, and related OT environments.

Cascading risk: KEV-driven remediation and uncoordinated patching could produce availability impacts that ripple into telecom and transport operational channels. Coordinate maintenance windows to reduce risk.

1. Inventory and isolate internet-accessible PLCs and HMIs; block direct internet access or require authenticated jump hosts. — OT Engineering / Network Ops

2. Execute telemetry hunts for advisory-provided IPs and Dropbear SSH activity. — SOC / OT SOC

3. Apply KEV-mandated remediation for CVE-2026-35616 per BOD 22-01. — Patch Management / IT Ops

1. Patch or apply vendor mitigations for Schneider EcoStruxure CVE-2024-2658 and validate system behavior.

2. Harden SSH and remote engineering endpoints: limit source IPs, enforce MFA, rotate keys, replace Dropbear where feasible.

• Implement network segmentation between IT and OT; enforce jump-host/bastion-centric access for engineering sessions.
• Maintain an asset inventory for OT devices and vendor software (Fortinet, Schneider, Rockwell) linked to patch status and maintenance windows.

DETECTION QUERIES

• Telemetry hunts: Search netflow/firewall/VPN/EDR for connections to 135.136.1[.]133 and 185.82.73[.]162–185.82.73[.]171 within the last 90 days.
• SSH detection: Alert on Dropbear SSH fingerprints, unauthorized SSH keys, and unusual authentication patterns to PLC jump hosts.

• Victim counts & scope: Advisory text and open reporting do not provide a comprehensive, verified list of affected U.S. victim organizations within the 7-day window.
• Telemetry correlation: Internal network/EPP/EDR telemetry was not available; enrichment required to confirm advisory IPs map to active intrusions.
• Follow-up: Enrich advisory IPs against internal telemetry; request vendor PSIRTs for Fortinet, Rockwell, and Schneider.

Generated by Protos AI · TLP:CLEAR · Weekly Brief #20 · 2026-04-07