Iranian Cyber Actors Target U.S. Critical Infrastructure: A Deep Dive into the CISA Alert

In a significant escalation of international cyber warfare, the Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the FBI and NSA, issued a joint cybersecurity advisory (AA26-097A) on April 7, 2026. The alert warns of persistent and targeted attacks by Iranian-affiliated advanced persistent threat (APT) actors against United States critical infrastructure. These actors have been specifically exploiting internet-facing Programmable Logic Controllers (PLCs), causing operational disruptions and financial losses across vital sectors including water, energy, and government facilities since at least March 2026.

Figure 1: CISA and FBI joint efforts to protect U.S. critical infrastructure from foreign cyber threats.

The Nature of the Threat

The current wave of attacks is attributed to Iranian-affiliated groups, most notably the CyberAv3ngers, which is linked to the Iranian Revolutionary Guard Corps (IRGC). These actors have shifted their focus toward Operational Technology (OT), the hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices, processes, and events.

By targeting PLCs—the "brains" of industrial processes—hackers can manipulate physical systems. In the context of water treatment plants, this could mean altering chemical levels or shutting down pumps. In the energy sector, it could involve disrupting power distribution or damaging expensive electrical equipment.

"Iranian-affiliated APT targeting campaigns against U.S. organizations have recently escalated, likely in response to hostilities between Iran, and the United States and Israel." — CISA Advisory AA26-097A 1

Technical Analysis of the Attacks

The hackers primarily target devices that are directly exposed to the public internet without adequate security measures. The primary victims have been users of Rockwell Automation/Allen-Bradley PLCs, specifically the CompactLogix and Micro850 models.

Initial Access and Exploitation

The attackers utilize overseas-based IP addresses to scan for and connect to internet-facing PLCs. Once a device is identified, they use legitimate industrial software, such as Rockwell Automation’s Studio 5000 Logix Designer, to establish a connection. This "living off the land" technique makes the intrusion harder to detect, as the hackers are using the same tools as authorized engineers.

Figure 2: Industrial Programmable Logic Controllers (PLCs) like these are the primary targets of the recent Iranian cyber campaign.

Command and Control (C2)

The advisory identifies several key ports used for malicious traffic:

• 44818: EtherNet/IP

• 2222: Common Industrial Protocol (CIP)

• 102: Siemens S7 communication

• 502: Modbus

• 22: SSH (specifically using Dropbear SSH for remote access)

The inclusion of ports associated with other vendors, such as Siemens, suggests that the scope of the Iranian campaign may extend beyond Rockwell Automation devices to a broader range of industrial hardware.

Impact on Critical Sectors

The consequences of these breaches are not merely digital; they have real-world physical and economic impacts. The FBI has confirmed that these attacks have resulted in:

1. Extraction of Project Files: Hackers steal the logic and configuration of the industrial process, which can be used for further sabotage or intellectual property theft.

2. Data Manipulation: Attackers have altered data on Human Machine Interface (HMI) and SCADA displays. This can mislead operators into taking incorrect actions or hide the fact that a system is being sabotaged.

3. Operational Downtime: Facilities have been forced to switch to manual operations or shut down entirely to remediate the breaches.

Focus on Water and Wastewater Systems (WWS)

The water sector has been particularly vulnerable. Many small to medium-sized water utilities lack the cybersecurity budget of larger energy companies, making them "soft targets."

Figure 3: The complex nature of water and wastewater systems makes them critical yet vulnerable targets for cyber sabotage.

Sector	Primary Impact	Economic Consequence
Water & Wastewater	Disruption of treatment processes, HMI manipulation	High remediation costs, public health risks
Energy	Potential grid instability, equipment damage	Revenue loss, infrastructure repair costs
Government Facilities	Interruption of essential services	Loss of public trust, administrative delays

Mitigation and Defense Strategies

CISA and its partners have provided a comprehensive set of recommendations to protect OT environments from these Iranian-affiliated actors.

Immediate Actions for OT Operators

• Disconnect PLCs from the Internet: Industrial controllers should never be directly accessible from the public internet. Use a secure VPN or a "jump host" if remote access is absolutely necessary.

• Change Default Credentials: Many attacks succeed simply because devices are still using factory-default usernames and passwords.

• Implement Multi-Factor Authentication (MFA): Ensure that any remote access to the OT network requires a second form of verification.

• Update Firmware: Regularly apply security patches provided by manufacturers like Rockwell Automation to close known vulnerabilities (e.g., CVE-2021-22681).

Long-term Resilience

Organizations are encouraged to adopt a "Secure by Design" approach, ensuring that security is integrated into the infrastructure from the beginning rather than added as an afterthought. This includes network segmentation—separating the industrial network from the corporate office network—to prevent a malware infection in an email from reaching the water pumps.

The 2026 CISA alert serves as a stark reminder that the boundary between digital conflict and physical safety is increasingly blurred. As geopolitical tensions rise, critical infrastructure becomes a primary battlefield. For the United States, protecting the systems that provide water, power, and government services is no longer just an IT challenge; it is a fundamental matter of national security.

References

1     CISA: Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure

2 FBI: Cyber Threat Overview and Advisories

3 Rockwell Automation: Security Advisory on PLC Hardening