Cybersecurity — 2026-04-08

FBI, NSA, CISA Warn Iranian Hackers Exploiting PLCs Across US Water, Energy and Government Systems

The FBI, NSA, CISA, and DOE issued a joint advisory on April 7 warning that Iranian-affiliated hackers have been exploiting Rockwell Automation Allen-Bradley programmable logic controllers across US water, energy, and government facilities since at least March 2026. The attackers manipulated HMI and SCADA displays, causing operational disruptions and financial losses. CSIS separately flagged Iran's shift from episodic cyberattacks to a sustained campaign against critical infrastructure, coinciding with the kinetic conflict.

Analysis
Prior IC Brief reporting tracked Iran's cyber escalation from hacktivism through three-tiered campaigns. The shift to PLC exploitation of industrial control systems marks a qualitative escalation, moving from data theft and defacement to physical process manipulation. The joint advisory's issuance coinciding with the kinetic ceasefire suggests the cyber front may accelerate as Iran seeks to maintain pressure below the threshold of the pause agreement.
3 sources
  1. Iranian hackers are targeting American critical infrastructure, US agencies warn - TechCrunch
  2. Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure - CISA
  3. Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn - CyberScoop

View in full brief →

UNCLASSIFIED // OPEN SOURCE