Under Siege: Iranian Cyberattacks on US Industrial Infrastructure

The Targeted Attack Surface of Iranian-Linked Hackers on U.S. Critical Infrastructure

Iranian-linked hackers have set their sights on U.S. critical infrastructure networks, particularly targeting Internet-exposed programmable logic controllers (PLCs) manufactured by Rockwell Automation. The joint advisory issued by multiple U.S. federal agencies reveals that these cyberattacks have been ongoing since March 2026, leading to operational disruptions and financial losses.

The escalating campaigns by Iranian state-backed hacking groups against U.S. organizations are believed to be a response to the heightened tensions between Iran, the United States, and Israel, as cautioned by the authoring agencies.

The FBI’s investigation revealed that the hacking activity resulted in the extraction of device project files and data manipulation on HMI and SCADA displays.

According to cybersecurity firm Censys, over 5,200 exposed industrial control systems globally, with three-quarters of them located in the United States, are at risk. The data highlights a significant concentration of EtherNet/IP (EIP) hosts self-identifying as Rockwell Automation/Allen-Bradley devices.

Network defenders are urged to fortify PLC security by implementing firewalls, disconnecting from the Internet if possible, monitoring logs for malicious indicators, and scrutinizing OT port traffic for anomalies, especially from foreign hosting providers.

To combat these persistent attacks, administrators are advised to enforce multifactor authentication (MFA), keep PLC devices updated, disable unused services and authentication methods, and remain vigilant for potential threats.

These recent cyber campaigns echo previous incidents where Iranian-affiliated threat groups targeted vulnerabilities in U.S.-based operational technology systems, such as the CyberAv3ngers’ attacks on Unitronics PLC devices and the Handala hacktivist group’s assault on Stryker’s network.

See also  Bank Support Team Impersonators Swindle $262M in Cybercrime Heist

Automated pentesting and BAS validation are crucial for cybersecurity. This whitepaper delineates six validation surfaces, identifies coverage gaps, and offers three diagnostic questions for evaluating security tools.

Get Your Copy Now