US agencies warn of Iranian cyberattacks on critical infrastructure

On Tuesday, several U.S. government agencies issued a joint advisory warning that Iranian government hackers have been exploiting internet-facing systems used across a range of sectors. These targeted systems include water, energy, and local government facilities. The Federal Bureau of Investigation (FBI), the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Department of Energy collectively asserted that these hackers are targeting American critical infrastructure. Although the agencies did not specifically name any of the targets, they stated that the hacks were aimed at causing disruptive effects within the United States and have already resulted in operational disruption and financial loss. The agencies noted that the hacks targeting critical infrastructure are a marked escalation in tactics by Iranian hackers, which is likely in response to the U.S.-Israel war with Iran.

The cyberattacks have targeted industrial control systems, specifically programmable logic controllers—which are industrial computer control systems—and supervisory control and data acquisition (SCADA) products used to control industrial equipment. The agencies stated that the hackers were able to manipulate information displayed on these devices and maliciously interact with project files that store important device configurations. Since the start of the war, an Iranian government-backed hacking group called Handala has been linked to several high-profile cyberattacks. These include a disruptive breach at Stryker, a U.S. medical tech giant, where hackers wiped thousands of employee devices. Additionally, the FBI recently blamed the Handala hackers for leaking the partial contents of the private email account of FBI director Kash Patel.

The advisory was published on Tuesday, amid heightened geopolitical tensions. Earlier that day, U.S. President Donald Trump threatened Iran in a social media post, warning that “A whole civilization will die tonight” if Iran does not capitulate to a deal with the United States to open the Strait of Hormuz, a key chokepoint for global shipping traffic. The ongoing conflict began on February 28, and the joint advisory highlights how the physical confrontation has extended into the digital domain, with hackers targeting essential systems such as water, energy, and local government facilities.

Why it matters

The U.S. government has issued a joint advisory warning that Iranian hackers are escalating their tactics by targeting critical infrastructure, including water, energy, and local government facilities, to cause operational disruption.