US Critical Infrastructure Facing Iranian-Linked OT Threats

Iranian-linked cyberthreat actors are actively positioning to exploit vulnerable internet-facing operational technology devices across U.S. critical infrastructure, the U.S. cyber defense agency warned Tuesday.

See Also: AI vs. AI: Leveling the Defense Playing Field

Threat actors are targeting programmable logic controllers manufactured by Rockwell Automation/Allen-Bradley, among other vulnerable OT devices in critical infrastructure sectors nationwide, according to an advisory the Cybersecurity and Infrastructure Security Agency published alongside the FBI, NSA and Department of Defense cyber units. The activity has already led to disruptions across multiple sectors, according to the advisory, “resulting in operational disruption and financial loss.” Rockwell Automation did not immediately respond to a request for comment.

The advisory comes amid the escalating U.S.-Israeli war on Iran and counterstrikes by Tehran on technology facilities and data centers throughout the region (see: Iran Commences Strikes on US Tech Firms in Middle East ).

Pro-Iranian hacking proxies have also promoted claims in recent days of successful operations and data breaches targeting Western firms, online platforms and defense contractors, though those reports are unverified.

The advisory urges critical infrastructure owners and operators to remove PLCs from direct internet exposure by placing them behind a secure gateway and firewall, and to scan logs for suspicious traffic. CISA also encouraged organizations to place Rockwell Automation devices on physical mode and to prioritize basic cyber hygiene as a frontline defense – including patching known vulnerabilities, enforcing multifactor authentication, limiting internet exposure of critical systems and strengthening monitoring for suspicious behavior.

The agencies said that PLCs and other OT assets can be directly reachable from the public internet due to misconfigurations. Legacy systems also create a persistent attack surface that adversaries can exploit with relatively low effort. Threat actors can gain a foothold and the ability to pivot across networks, escalate privileges and even interact directly with control processes.

The advisory follows recent reporting that Iranian cyber activity is increasingly focused on critical infrastructure environments where basic security gaps can be exploited quickly (see: Iranian Cyberthreats Test U.S. Infrastructure Defenses).

Analysts say Iranian-linked groups have historically demonstrated a willingness to target industrial environments during periods of geopolitical tension, using disruptive or destructive techniques to amplify impact. U.S. President Donald Trump has repeatedly threatened to bomb Iranian civilian infrastructure including power and desalination plants. On Tuesday morning, he asserted that “A whole civilization will die tonight, never to be brought back again” unless Iran allows shipping through the Strait of Hormuz by 8 p.m.