The US government has warned that hackers linked to Iran are actively targeting industrial control systems used by water and energy providers across the country.
Federal agencies say the attackers are attempting to disrupt essential services by gaining access to internet-connected operational networks. The latest advisory highlights growing cybersecurity risks facing America’s major infrastructure.
Agencies Issue Warning
The updated advisory was released on Wednesday by the Federal Bureau of Investigation (FBI), the National Security Agency (NSA), the Department of Energy, and the Cybersecurity and Infrastructure Security Agency (CISA).
The agencies said the hackers are focusing on programmable logic controllers(PLCs), which are small industrial computers that control machines and automated processes. If compromised, these systems can interfere with equipment used in power plants, water treatment facilities, and other essential services.
Earlier investigations found that the attackers were mainly targeting controllers manufactured by Rockwell Automation. The updated warning now includes industrial control products made by Schneider Electric and Siemens. Federal officials also warned that nearly all internet-connected industrial control systems may face similar risks if left exposed.
The advisory said the Iranian-backed hackers are carrying out these activities to create disruptive effects inside the US. According to the agencies, the campaign is likely linked to the ongoing conflict involving Iran, the United States, and Israel. Officials urged operators of critical infrastructure to strengthen security measures immediately.
Hackers Exploit Industrial Controllers
According to the FBI, one attack involved hackers changing the programming logic inside industrial controllers at a major infrastructure provider. The altered settings disabled processes responsible for emergency shutdowns and safety alarms. As a result, equipment could continue operating under unsafe conditions without alerting system operators.
READ ALSO: ORNL to Lead Nine DOE Genesis Mission Projects Driving AI, Fusion and Future US Science
Industrial control systems differ from traditional computer networks because they manage physical equipment rather than digital information alone. They regulate pumps, valves, motors, and other machinery that keep essential services running. A successful attack on these systems can interrupt operations even without stealing sensitive data.
The agencies advised organisations to reduce internet exposure for operational technology wherever possible. They also recommended monitoring network activity, updating software, and reviewing access controls to reduce the chances of unauthorised access. These steps are considered basic but important defences against cyber intrusions.
Recent Attack Pattern
The latest warning follows several cyber operations linked to Iranian government-backed groups and affiliated hackers since the conflict began in February. Recent campaigns have included traditional espionage, data theft, information leaks, and destructive cyberattacks. Security experts say this marks a wider range of tactics than seen in many previous operations.
One widely reported incident involved US medical technology company Stryker. Iranian-linked hacking group Handala claimed responsibility for an attack that reportedly enabled the remote wiping of tens of thousands of employee devices. Such attacks aim to disrupt business operations rather than collect information.
Handala also claimed responsibility for a data breach involving California water provider Cal Water in June. The group said it could disrupt the company’s water supply, although it did not provide evidence to support that claim. Cal Water later said it found no evidence of unauthorised access to the operational networks that control its water systems.
Infrastructure Security Focus
The latest advisory reflects increasing concern over cyber threats targeting infrastructure that millions of people rely on every day. Water treatment plants, electricity networks, and industrial facilities depend on connected control systems to operate efficiently, making them attractive targets for state-backed hackers. Even limited disruptions can affect public services and increase operational risks.
Federal agencies continue to encourage organisations managing major infrastructure to strengthen cybersecurity before attacks occur rather than responding after systems are compromised. As geopolitical tensions remain high, protecting operational technology has become an important part of national security and the reliable delivery of essential services.
