US warns Iranian hackers escalating attacks on OT assets

• FBI, NSA, CISA, EPA, Department of Energy, and US Cyber Command’s Cyber National Mission Force claim the actors aim to cause disruptive effects inside the United States.
• Activity has hit unnamed organisations in government services and facilities, water and wastewater systems, and the energy sectors.

US cybersecurity, law enforcement, and intelligence agencies on Tuesday warned that Iran‑affiliated hackers are intensifying campaigns against operational technology in multiple critical infrastructure sectors, targeting publicly exposed programmable logic controllers (PLCs) and supervisory control and data acquisition (SCADA) displays.

According to a joint advisory from the FBI, NSA, CISA, EPA, Department of Energy, and US Cyber Command’s Cyber National Mission Force, the actors aim to cause disruptive effects inside the United States.

Officials said some intrusions have already led to operational disruption and financial losses, with attackers manipulating display data, extracting device project files, and interacting with OT assets in ways that can impact real‑world processes.

Heightened regional tensions

The activity has hit unnamed organisations in government services and facilities, water and wastewater systems, and the energy sector, underscoring the risks posed by internet‑exposed industrial controllers and insufficient segmentation between IT and OT networks, the agencies said.

The alert arrives amid heightened regional tensions. While officials did not link specific incidents to recent military developments, security researchers and federal alerts describe a pattern of Iran‑aligned threat activity seeking to exploit readily accessible OT devices for disruptive impact rather than espionage, raising concerns about critical services’ resilience to adversary operations.

Agencies urged immediate hardening steps, including removing PLCs and HMIs from direct internet exposure, enforcing multifactor authentication and strong access controls, applying vendor security updates, segmenting networks, enhancing monitoring for unauthorised changes to OT configurations, and developing incident response playbooks tailored to industrial environments.

Related Posts:

• Middle East Geopolitics casts shadow over AI-powered cloud boom
• Iran strike damages AWS facility in Bahrain
• Iranian hackers targeting critical infrastructure