The CTO at NCSC reported this week that threat actors have compromised PLCs—the embedded computers that control machinery and physical processes—across several U.S. critical infrastructure sectors. The attack vector is notable: malicious project files used to interact with PLCs, combined with manipulation of data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) systems.
The operational impact was real. These actions disrupted critical infrastructure operations and resulted in financial losses, according to the NCSC summary. This is not theoretical vulnerability research—this is documented operational disruption in active infrastructure.
Why this matters: PLCs are the nervous system of critical infrastructure. They control power grid switches, water treatment processes, manufacturing lines, and other essential services. When adversaries can inject malicious code through project files and corrupt the data operators see on their screens, they create a dual problem: the system may malfunction while operators receive false information about what's actually happening. This combination obscures the attack and delays response.
The use of project files as attack surface is significant. These are often transferred across networks, shared with contractors, or updated during maintenance—creating multiple infection vectors that bypass traditional perimeter defenses.
What to watch next: Monitor your sector's ICS-CERT advisories and vendor security bulletins for patches related to PLC project file validation. Organizations operating critical systems should implement strict controls on project file sources, air-gap development environments where possible, and validate that HMI/SCADA data matches actual system state through independent verification. This attack class will likely be replicated across threat actors; attribution and motive remain unclear, but the capability is now demonstrated in operational environments.
