#cisa

Kinetic Escalation with Iran Rekindles Cyber Threats Targeting Exposed US Industrial Control Systems

Recent military strikes between the United States and Iran have triggered fresh concerns regarding retaliatory cyberattacks against American critical infrastructure. Following U.S. strikes on rocket launchers at Larak Island, Iranian forces retaliated with ballistic missiles and explosive drones targeting air bases in Jordan and the United Arab Emirates. Historically throughout this conflict, kinetic exchanges have closely correlated with aggressive probing and exploitation of industrial control systems by Iranian state-sponsored actors. Federal cyber authorities, including CISA, the FBI, and the NSA, previously issued joint advisories warning that threat groups are aggressively scanning for and compromising internet-facing programmable logic controllers. While initial warnings focused on Rockwell Automation equipment, federal agencies expanded their guidance in late July to encompass exposed hardware from Siemens and Schneider Electric. That update preceded a major campaign that disrupted operational technology across more than 30 Minnesota community water facilities, forcing operators into manual operations mode. CISA subsequently tracked targeting attempts against more than 100 internet-connected water systems throughout July, with the EPA and FBI identifying disruptions across at least seven states. An IRGC-linked group calling itself APT IRAN—associated with the CyberAv3ngers persona—publicly claimed credit for the July incidents and recently issued fresh warnings threatening disruptive operations across the energy, water, and telecommunications sectors. Although official intelligence agencies have withheld public attribution to a specific group, the targeting environment remains critical due to widespread operational technology misconfigurations. The United States operates over 150,000 public water systems, many of which lack dedicated security personnel to defend against network-level intrusions.