OT/ICS PLC Defense: Algeria’s Playbook After CISA AA26-097A

What AA26-097A Actually Reported

Advisory AA26-097A, released by a joint authorship of CISA, FBI, NSA, EPA, DOE, and US Cyber Command on April 7, 2026, describes an ongoing campaign against internet-connected operational technology (OT) devices across multiple US critical infrastructure sectors — Government Services and Facilities, Water and Wastewater Systems, and Energy — attributed to a state-backed advanced persistent threat group.

The key technical findings, extracted from the public advisory and follow-on analysis by Picus Security, RedSeal, Industrial Cyber, and 1898 & Co. (Burns & McDonnell):

• Primary targets: Rockwell Automation Allen-Bradley programmable logic controllers (PLCs), particularly ControlLogix-family devices.
• Core technique: Operators leased third-party cloud hosting and ran Rockwell’s own Studio 5000 Logix Designer engineering software to create legitimate-looking connections to victim PLCs. Because the sessions use the vendor’s authentic engineering tool, most network detection rules classify them as normal engineering traffic.
• Key CVE in play: CVE-2021-22681 — an insufficiently protected cryptographic key in Studio 5000 and Logix PLCs — added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in March 2026.
• Outcome: Some victims experienced operational disruption and financial loss, including disrupted process control states on PLCs.

The takeaway for defenders is not country-attribution; it is that a determined state-backed APT using legitimate engineering tooling can reach internet-exposed PLCs without burning any zero-days. The weakness is architectural.

Algeria’s OT Attack Surface

Algeria recorded over 70 million cyberattacks in 2024 and ranks 17th globally among most-targeted nations, according to the national strategy published under Presidential Decree 25-321 (December 2025). The strategy explicitly designates energy, water, telecommunications, transportation, financial services, and government services as Critical Information Infrastructure (CII), with ANSSI / ASSI coordinating sector-specific security baselines.

The OT estates that map directly onto AA26-097A’s findings:

• Sonatrach hydrocarbons. Upstream pipelines, refineries, LNG terminals at Skikda and Arzew, and thousands of wellhead and compressor PLCs. Studio 5000 / ControlLogix is widely deployed across the gas value chain.
• Sonelgaz power generation and distribution. Thermal plants, distribution substations, and the national dispatching centre rely on SCADA/PLC stacks from Schneider, Siemens, and Rockwell.
• Algérienne des Eaux (ADE) and ONA wastewater. Mostly PLC-driven, with growing remote-telemetry for pumping stations and distribution networks.
• Metro d’Alger and rail OT. PLC-based signalling and station automation.
• Cement, fertilizer, steel, petrochemicals. Large private and SOE plants with legacy ICS estates often running unsupported HMI/SCADA software.

The 10-Point OT Defender Checklist for Algerian CII Operators

This checklist consolidates AA26-097A recommendations, Rockwell’s own System Security Design Guidelines (Publication SECURE-RM001J, November 2025), IEC 62443, and NIST SP 800-82. It maps to ANSSI’s sector-specific expectations under Decree 25-321:

1. Complete asset inventory. Every PLC, RTU, HMI, engineering workstation, and Windows historian on every plant. Tools: Claroty, Dragos, Nozomi, or Tenable OT Security. No inventory, no defense.
2. Internet-exposure scan. Use Shodan, Censys, and passive in-country scanning to confirm no PLC or HMI is exposed to the public internet. AA26-097A’s core finding is that exposed Allen-Bradley PLCs were the entry point.
3. Purdue Model zoning. Enforce Level 0-1 (sensors/PLCs) and Level 2 (HMI/SCADA) segregation from Level 3 (operations DMZ) and Level 4-5 (enterprise IT) with hardware firewalls and unidirectional data diodes where practical.
4. PLC credential and key hardening. Rotate default credentials. Disable unused CIP services. For Rockwell, enable CIP Security (authenticated and integrity-protected communications) where controllers support it.
5. Studio 5000 / engineering workstation lockdown. AA26-097A shows attackers abusing legitimate engineering software. Tier 0 engineering workstations should be: not internet-connected, with Windows application allowlisting, requiring smart-card/FIDO2 MFA, never used for email or web browsing.
6. Log retention and visibility. Minimum 12-month retention of OT network logs, PLC change logs, and engineering session logs. Forward to a SIEM or OT-specific platform (Splunk, Claroty xDome, Dragos Platform).
7. Patch KEV-listed ICS vulnerabilities. CVE-2021-22681 (Studio 5000) is the specific one in AA26-097A, but check the full CISA KEV catalog every month against your PLC firmware inventory.
8. Incident response playbook. An OT-specific playbook distinct from IT IR. Define safe-state procedures for each critical process. Rehearse with operators, not just cybersecurity staff.
9. Third-party and vendor access. AA26-097A showed the attackers using leased cloud infrastructure. Audit all external remote access: vendor VPNs, integrator accounts, cloud-based remote monitoring. Replace shared credentials with per-individual accounts and MFA.
10. ANSSI / DZ-CERT coordination. Under Decree 25-321, CII operators are expected to report significant OT incidents and anomalous PLC behaviour to ANSSI / ASSI. Establish the liaison channel before you need it.

Where Algerian Operators Typically Fall Short

Honest reality-check from public incidents in the region and industry surveys:

• Flat OT networks. Many Algerian plants run a single flat OT VLAN. Purdue zoning is aspirational rather than enforced.
• Engineering workstations with internet access. Patch delivery and vendor remote assistance drive operators to internet-connect Tier 0 hosts.
• Stale PLC firmware. Plants avoid firmware updates because a failed update can idle a production line. Risk-based patching with scheduled maintenance windows is the honest compromise.
• Outsourced integrator access. Single shared VPN credentials, no MFA, logged only on the integrator’s side.

AI-based OT security platforms (Claroty xDome, Dragos) generate risk-based compensating controls that let operators maintain safety while delaying patches to scheduled maintenance windows — a pragmatic approach for Algerian plants where unplanned downtime costs are an order of magnitude above patch-management costs.

Bottom Line for Algerian CII Operators

AA26-097A did not reveal a new zero-day. It documented that a well-resourced APT can, with patience and legitimate tools, reach PLCs that operators assumed were isolated. Algerian utilities, petrochemical plants, and water operators have the same architectural gaps as the US victims documented in the advisory. The defender checklist is proven — the question is whether Algerian CII operators will fund the inventory, zoning, and IR investments before an incident, or after.

Sources & Further Reading

• Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure — CISA AA26-097A
• CISA Advisory AA26-097A — ICS/PLC Threats to Critical Infrastructure
• Rockwell Automation System Security Design Guidelines (SECURE-RM001J-EN-P)
• Ongoing Cyberattacks Targeting Internet-Connected PLCs — Industrial Cyber
• Cybersecurity at the Core of Algeria’s Digital Sovereignty — DzairTube / ASSI coverage
• How to Cloak Critical Infrastructure: Protecting Internet-Exposed PLCs — Zentera