CISA Alert: Iranian Attacks on PLCs, Interlock Ransomware, and the Stealthy LummaC2

Introduction

In recent days, there has been talk of a Russian phishing campaign targeting Zimbra Collaboration Suite users, but the official material available provides no confirmation. The advisories published by the Cybersecurity and Infrastructure Security Agency (CISA) between May 2025 and April 2026, however, tell a different story—one of concrete threats ranging from critical infrastructure to digital identity theft. This article analyzes the actual contents of the CISA alerts, offering an updated overview of what defenders and security managers need to know today.

Technical Analysis

The four advisories, although unrelated, outline an articulated risk landscape.

Exploitation of PLCs by Iranian threat actors (AA26-097A, April 7, 2026)
The target is US critical infrastructure. Programmable logic controllers (PLCs), the backbone of industrial automation, are targeted using techniques that likely include sending malicious commands over the network or unauthorized access to exposed control panels. The operation suggests an adversary with persistent offensive capabilities and intentions of physical sabotage, not merely espionage.

Interlock ransomware (AA25-203A, July 22, 2025)
Interlock is a ransomware family that adopts the "double extortion" tactic: it encrypts data on-premises and threatens to leak it unless the ransom is paid. The distribution methods, although not detailed in the advisory, are typically associated with malicious emails or unpatched software vulnerabilities. The encryption affects file servers, databases, and workstations, paralyzing business operations.

Data exfiltration with LummaC2 (AA25-141B, May 21, 2025)
LummaC2 is an infostealer that operates stealthily to capture login credentials, session cookies, cryptocurrency wallets, and banking data. Often distributed via cracked software or fake updates, it sends stolen profiles to command-and-control servers, fueling a thriving digital black market that facilitates subsequent attacks.

Threat hunting and cyber hygiene (AA25-212A, July 31, 2025)
More than a compromise notification, this advisory underlines the value of proactive threat hunting activities and improving cyber hygiene in a large critical organization. The goal is to reduce the attack surface and detect anomalies before they become incidents.

Impact

The consequences of these threats can be serious and cross-cutting:

• Industrial control systems: manipulation of PLCs can lead to plant shutdowns, equipment damage, and public safety risks.
• Ransomware activities: unavailability of data and potential exposure of sensitive information cause economic losses, service interruptions, and reputational damage.
• Theft of credentials and financial data: LummaC2 exposes individuals and businesses to fraud, account draining, and corporate account compromise, with the risk of lateral movement within networks.
• Cyber hygiene deficiencies: failure to adopt basic security practices amplifies the effectiveness of any attack vector, turning known vulnerabilities into easily exploitable gaps.

Mitigation

For specific guidance and indicators of compromise, it is essential to consult the full CISA documents (AA26-097A, AA25-212A, AA25-203A, AA25-141B). In general, organizations should:

• Isolate industrial networks from administrative ones and apply strict segmentation.
• Consistently update operating systems, PLC firmware, and applications.
• Deploy EDR/XDR solutions and keep them configured for automatic blocking.
• Train users on phishing recognition and safe handling of attachments.
• Enable multi-factor authentication wherever possible and apply the principle of least privilege.
• Set up offline and redundant backups, periodically verifying their integrity.
• Establish continuous threat hunting processes and log monitoring to detect suspicious activity in a timely manner.

FAQ

1. Why is Zimbra mentioned if the sources do not discuss it?
The material received, consisting exclusively of CISA advisories, contains no details about phishing campaigns against Zimbra. The hypothesis may have arisen in unofficial channels, but currently there is no evidence in the verified sources. To obtain reliable information on Zimbra, another source would be needed.

2. Is LummaC2 dangerous for private users as well?
Yes, because it is designed to steal credentials, cookies, and financial data from individuals. Once stolen, this information can be used for unauthorized access to bank accounts, social media, and corporate platforms, with significant financial and personal consequences.

3. What immediate measures can I take against Interlock ransomware?
In addition to regular offline backups, ensure all security patches are applied, restrict account privileges, disable unnecessary macros in documents, and train staff not to open suspicious attachments. In case of infection, immediately isolate the device from the network and contact the incident response team.