- US agencies issued a joint security advisory warning of an ongoing attack
- Rockwell Automation/Allen-Bradley-manufactured programmable logic controllers (PLCs) are under fire
- The breaches resulted in disruptions and loss of funds
Major US agencies, including the FBI, CISA, NSA, and others, have released a joint security advisory warning critical infrastructure organizations in the country about ongoing Iranian attacks against their endpoints.
The agencies said an Iranian-affiliated threat actor is currently trying to exploit internet-connected operational technology devices (OT), including Rockwell Automation/Allen-Bradley-manufactured programmable logic controllers (PLCs), “with the intent to cause disruptions”.
“As a result of this activity, organizations from multiple US critical infrastructure sectors experienced disruptions through malicious interactions with the project files and the manipulation of data displayed on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays,” the advisory reads. “In a few cases, this activity has resulted in operational disruption and financial loss.”
CyberAv3ngers' fingerprints
The advisory did not say which organizations experienced these disruptions and financial loss, but it did say Government Services and Facilities (to include local municipalities), Water and Wastewater Systems (WWS), and Energy Sectors, were among the targets.
In its writeup, The Record says a water treatment plant in Minot, North Dakota, reported a ransomware attack last week. While the publication hinted the two incidents might be connected, there is no confirmation yet, and no groups have taken responsibility for the incident.
The attacks started in March 2026 and are most likely in response to the military conflict currently taking place in Iran.
US and Israeli forces targeted, among other things, Iranian critical infrastructure such as nuclear facilities, petrochemical plants and industrial sites, and railways and bridges.
The authoring agencies did not name the group conducting these attacks but stressed that they previously reported on similar activity from a group called CyberAv3ngers (AKA Shahid Kaveh Group). This group is allegedly affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC) Cyber Electronic Command (CEC).
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!
And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.