Iranian hackers' targeting of US critical infrastructure has escalated since start of war, US says

Lead

US cybersecurity, law enforcement, and intelligence agencies have issued a joint advisory warning that Iranian hacking campaigns targeting American critical infrastructure are escalating in response to hostilities. The advisory, released on Tuesday, urges municipalities—especially those in the water and energy sectors—to be vigilant for unusual activity.

Coverage Comparison

The warning was reported by multiple outlets, including The Guardian, the Jerusalem Post, and The Hindu. While all three sources conveyed the core message of the advisory, there were slight differences in emphasis. The Guardian focused on the threat to public health and the potential impact on drinking water and wastewater systems, quoting an Environmental Protection Agency (EPA) official. The Jerusalem Post highlighted the escalation of hacking campaigns and tied the warning to President Donald Trump's recent threats against Iran. The Hindu provided a straightforward account of the advisory, listing the agencies involved.

Key Claims

• The joint advisory was issued by the FBI, the National Security Agency, the Cybersecurity and Infrastructure Security Agency, the Environmental Protection Agency, the Department of Energy, and US Cyber Command’s Cyber National Mission Force, as reported by all three sources.
• Hackers are targeting publicly exposed programmable logic controllers and supervisory control and data acquisition displays, which are used to interact with or control critical infrastructure equipment and systems, according to the advisory.
• The hackers are seeking to cause “disruptive effects within the United States,” and in a few cases, the activity has resulted in operational disruption and financial loss, as stated in the advisory.
• Targets include unnamed organizations in the government services and facilities, water and wastewater systems, and energy sectors, as confirmed by multiple sources.
• In some cases, hackers altered display data and extracted device project data, according to the advisory.
• The advisory did not specify whether particular facilities had been targeted or whether any damage had been sustained, according to The Guardian and The Hindu.

Perspectives

The warning arrives amid heightened tensions between the US and Iran. President Trump posted on social media early Tuesday that “a whole civilization will die tonight, never to be brought back again” if Iran did not meet his demands, as reported by The Guardian and the Jerusalem Post. Trump gave Iran a deadline to reopen the Strait of Hormuz, which culminated in a two-week ceasefire subject to the “COMPLETE, IMMEDIATE, and SAFE OPENING” of the strait, according to The Guardian.

Iran has said it would attack additional infrastructure targets across its Gulf neighbors, as reported by the Jerusalem Post.

Background

Iran has been accused for years of carrying out cyberattacks on various countries, including a massive power outage in Turkey in 2015 and several possible breaches of Israeli government websites in 2022, as noted by The Guardian. The US also alleged that an Iran-affiliated group known as “CyberAv3ngers” conducted a campaign in 2023 that compromised at least 75 devices in multiple infrastructure sectors. Iran, in turn, has accused the US and Israel of carrying out cyberattacks against it, including on its nuclear centrifuges and weapons systems, according to The Guardian.

Jeffrey Hall, an assistant administrator for enforcement and compliance assurance for the EPA, was quoted in The Guardian as saying, “Cyberattacks on drinking water and wastewater systems directly threaten public health and community resilience. A single breach can disrupt treatment or introduce contaminants, damage equipment, and erode public trust.”

The advisory serves as a reminder of the growing threat to critical infrastructure from state-sponsored hacking groups, and the need for vigilance among operators of essential services.