BAUXITE PLC Campaign Targets Internet-Exposed Industrial Controllers

Iranian state-affiliated threat actors tracked as BAUXITE are actively exploiting internet-exposed programmable logic controllers across U.S. critical infrastructure. The campaign marks an escalation from earlier Iranian OT activity because the actors are no longer relying on default credentials alone. They are using Rockwell Automation Studio 5000 Logix Designer to connect to exposed CompactLogix and Micro850 PLCs in a way that is technically indistinguishable from authorized remote engineering activity. Once access is established, the actors extract .ACD project files, deploy Dropbear SSH for persistence, and manipulate HMI and SCADA displays. U.S. government agencies also assess destructive capability within the scope of this campaign.

The central weakness is architectural, not merely procedural. PLCs were never designed for direct internet exposure, and no signature-based detection stack can compensate for that condition. The highest-value immediate actions are straightforward: remove PLCs from internet access, set hardware key switches to RUN mode, and verify that default credentials are not present anywhere in the environment.

• ▸ BAUXITE uses legitimate Rockwell engineering software (Studio 5000 Logix Designer) for initial access, making signature-based detection ineffective and behavioral engineering session baselines essential.
• ▸ Targeted devices include Rockwell CompactLogix and Micro850 PLCs. Observed port targeting on 102 (Siemens S7 ISO TSAP) and 502 (Modbus TCP) indicates a multi-vendor targeting model extending beyond Rockwell environments.
• ▸ Persistence is established via Dropbear SSH - a legitimate open-source SSH implementation that reduces forensic visibility in poorly monitored OT environments. No file hashes are available; focus on process execution behavior.
• ▸ Extraction of .ACD project files gives actors an operational blueprint containing ladder logic, I/O configuration, tag databases, and process parameters - providing detailed process-level understanding before any manipulation begins.
• ▸ HMI and SCADA display manipulation creates an operator deception condition. Falsified display data misleads operators, masks physical anomalies, and increases the probability of erroneous response during a live incident.
• ▸ Seven of the eight confirmed IOC addresses sit within 185.82.73.0/24 and have been active since January 2025, indicating sustained infrastructure that predates the March 2026 campaign escalation by over a year.
• ▸ No file hashes have been published. Behavioral monitoring, engineering session baselining, and process-aware detection are the primary defensive path. IOC blocking is necessary but not sufficient against this campaign.

BAUXITE is an Iranian state-sponsored threat group attributed to the IRGC Cyber Electronic Command. The campaign reflects a maturation of Iranian OT targeting from opportunistic controller access into a more operationally informed intrusion model. The actors demonstrate familiarity with Rockwell software ecosystems, EtherNet/IP protocol behavior, PLC project file structures, and the operational realities of industrial environments.

The threat is not limited to a single victim class. The confirmed victim sectors are Government Services and Facilities, Water and Wastewater Systems, and Energy, but the scan pattern is broader. BAUXITE is scanning industrial protocol ports internet-wide, which means any organization operating internet-reachable PLCs is a viable target whether or not it appears in the currently confirmed victim list.

The most important technical distinction in this campaign is that the adversary is using trusted engineering pathways rather than obviously malicious tooling for initial access. A BAUXITE connection using Studio 5000 can look identical to a legitimate remote engineering session unless defenders have established behavioral baselines around approved source IPs, maintenance windows, and authorized change pathways. This makes the campaign especially dangerous in environments where OT access governance is weak and security teams lack visibility into engineering activity.

The operational risk is unusually high because the actors are not stopping at access. By extracting .ACD project files, they gain process-level understanding of the environment. By manipulating HMI and SCADA displays, they create a condition where operators act on false information. In water environments, this affects treatment and dosing decisions. In energy environments, it influences substation control and monitoring. In government facilities, it can affect HVAC, physical access, and building automation systems.

The bulletin provides a layered detection model that prioritizes behavioral monitoring over pure IOC matching because BAUXITE uses legitimate engineering software and common administrative pathways. Detections are separated into standard SIEM-compatible analytics and OT platform-dependent analytics, reflecting the reality that some detections are not feasible without industrial protocol visibility. Signature-only approaches are explicitly insufficient because the initial access method is indistinguishable from legitimate engineering activity without behavioral context.

The bulletin is explicit that no detection control fully compensates for direct internet exposure of PLCs. The most effective immediate mitigation is to eliminate that exposure and enforce hardware and network boundaries that prevent unauthorized engineering access.