{"id":9156,"date":"2026-04-07T20:47:56","date_gmt":"2026-04-07T20:47:56","guid":{"rendered":"https:\/\/sawahsolutions.com\/range\/pro-iran-hackers-have-disrupted-some-industrial-control-systems-us-says\/"},"modified":"2026-04-07T20:47:57","modified_gmt":"2026-04-07T20:47:57","slug":"pro-iran-hackers-have-disrupted-some-industrial-control-systems-us-says","status":"publish","type":"post","link":"https:\/\/sawahsolutions.com\/range\/pro-iran-hackers-have-disrupted-some-industrial-control-systems-us-says\/","title":{"rendered":"Pro-Iran hackers have disrupted some industrial-control systems, US says"},"content":{"rendered":"
\n

Iran-aligned hackers have exploited and disrupted operational technology control systems embedded in U.S. critical infrastructure, according to a federal\u00a0advisory issued Tuesday.<\/p>\n

\u201cThe authoring agencies assess a group of Iranian-affiliated advanced persistent threat (APT) actors is conducting this activity to cause disruptive effects within the United States.\u201d the advisory reads. \u201cThe group has targeted devices spanning multiple U.S. critical infrastructure sectors, including Government Services and Facilities (to include local municipalities), Water and Wastewater Systems (WWS), and Energy Sectors.\u201d<\/p>\n

The\u00a0assessment\u00a0was signed by the Cybersecurity and Infrastructure Security Agency, FBI, NSA, EPA, the Department of Energy, and U.S. Cyber Command\u2019s Cyber National Mission Force.<\/p>\n

It says hackers are especially targeting Rockwell Automation’s\u00a0Allen-Bradley line of programmable logic controllers, or PLCs, which monitor and automate the equipment used in\u00a0industrial processes such as water treatment, power generation,\u00a0and manufacturing.<\/p>\n

It says that the hackers have\u00a0manipulated\u00a0data on human-machine interfaces and on supervisory control and data acquisition, or SCADA, displays, and had harmful interactions with project files.<\/p>\n

The advisory is the latest signal that Iran-aligned hacker groups have impeded U.S. systems since the United States and Israel went to war against Iran on Feb. 28.\u00a0<\/p>\n

It comes after an apparent Tehran-backed hacker group carried out a cyberattack against medical technology giant Stryker last month, which wiped employees\u2019 phones and prevented workers from accessing their computers.<\/p>\n

A request for comment sent to Rockwell Automation\u2019s media relations email bounced back.<\/p>\n

Pro-Iran hackers have made a habit of targeting any computer systems tied to nations deemed foreign adversaries by Tehran, especially the U.S. and Israel. In late 2023, amid the Israel-Hamas war, one hacker group defaced the interfaces of water treatment systems in Pennsylvania, which had Israel-made Unitronics equipment built inside.<\/p>\n

In 2020, Rockwell Automation acquired Israel-based Avnet Data Security, aiming to bolster the cyber posture of its industrial control systems and operational technology.<\/p>\n

The assessment urged organizations to keep PLCs off the open internet, review logs for suspicious activity and lock down affected Rockwell devices to prevent unauthorized access. Unsecured internet-connected operational technology can expose industrial systems to remote access, giving attackers a pathway to disrupt or manipulate functions.<\/p>\n

The Iran war has been widely expected to test the strength of U.S. cyberdefenses, and experts have warned that exposed devices would be a potential target for pro-Iran hackers.<\/p>\n

President Donald Trump escalated his threats against Tehran on Tuesday, saying a \u201cwhole civilization will die tonight\u201d if Iran doesn\u2019t open the Strait of Hormuz by an 8 p.m. ET deadline.\u00a0<\/p>\n

Trump has promised to attack \u201cevery bridge\u201d and power station in the country if a deal isn\u2019t reached. Iran has promised a \u201cdevastating\u201d response if such an attack occurs. Any sharp escalation could heighten the risk of retaliatory cyberattacks.\n\n<\/svg><\/p>\n<\/div>\n