Iran-linked hackers disrupt operations at US critical infrastructure sites

Multiple U.S. critical infrastructure sites are facing operational disruptions attributed to hackers affiliated with the Iranian government, according to warnings from a coalition of six government agencies. This alert was issued on Tuesday by the FBI, Cybersecurity and Infrastructure Security Agency, National Security Agency, Environmental Protection Agency, Department of Energy, and U.S. Cyber Command. These agencies describe the attackers as part of an advanced persistent threat (APT) group, currently focusing their efforts on programmable logic controllers (PLCs). These PLCs, which are crucial in automating and managing industrial processes, can be found in a variety of settings, including factories, water treatment facilities, and oil refineries. Some of these devices are located in remote areas, making them vulnerable to cyber intrusions. The advisory indicates that since at least March 2026, this Iranian-affiliated group has been actively disrupting the functions of PLCs across various sectors of U.S. critical infrastructure, including government services, wastewater systems, and energy sectors. Many of the affected organizations have reported operational interruptions and financial losses due to these attacks. Of particular concern are the PLCs manufactured by Rockwell Automation/Allen-Bradley. A recent scan by cybersecurity firm Censys revealed that 5,219 of these devices are exposed to the Internet, with approximately 75% located in the United States. The infrastructure utilized for these attacks is identified as a single multi-home Windows engineering workstation that employs the Rockwell tool chain for targeting PLCs.