Hackers working on behalf of the Iranian government are disrupting operations at multiple US critical infrastructure sites, likely in response to the country’s ongoing war with the US, a half-dozen government agencies are warning.
In an advisory published Tuesday, the FBI, Cybersecurity and Infrastructure Security Agency, National Security Agency, Environmental Protection Agency, Department of Energy, and US Cyber Command “urgently” warned that the APT, or advanced persistent threat group, is targeting PLCs, short for programmable logic controllers. These devices, typically the scale of a toaster, sit in factories, water treatment centers, oil refineries, and other industrial settings, often in distant locations. They supply an interface between computers used for automation and physical machinery.
Operational disruption and financial loss
“Since a minimum of March 2026, the authoring agencies identified (through engagements with victim organizations) an Iranian-affiliated APT-group that disrupted the function of PLCs,” the advisory stated. “These PLCs were deployed across multiple US critical infrastructure sectors (including Government Services and Facilities, Waste Water Systems (WWS), and Energy sectors) inside a wide selection of business automation processes. A number of the victims experienced operational disruption and financial loss.”
Among the many PLCs being compromised or targeted are those made by Rockwell Automation/Allen-Bradley. Security firm Censys said Wednesday that an Web scan it performed identified 5,219 such devices exposed to the Web. A full 75 percent of them were positioned within the US and certain in far-off locations where equipment is positioned. The infrastructure getting used to focus on the devices is a “single multi-home Windows engineering workstation running the Rockwell tool chain.”