Adversary Intelligence — 2026-04-15

CISA Warns Iranian-Linked Hackers Targeting U.S. Critical Infrastructure PLCs Amid War

Federal agencies including CISA and FBI issued warnings that Iranian-affiliated APT groups have been targeting programmable logic controllers across multiple U.S. critical infrastructure sectors including energy, water, and government facilities since at least March 2026. Groups including Void Manticore and MuddyWater are deploying reconnaissance tooling at scale to identify and exploit public-facing applications, while the Iran conflict has blurred lines between state-sponsored espionage and cybercrime as operators increasingly leverage underground criminal infrastructure.

Analysis
CyberAv3ngers' default-credential playbook has expanded into coordinated multi-group PLC targeting, with MuddyWater and Void Manticore now operating against overlapping energy, water, and government target sets, a likely organizational escalation within IRGC cyber operations, per the underlying CISA/FBI/USCYBERCOM joint advisory summarized in trade reporting. State operators leveraging underground criminal tooling very likely complicate attribution and render traditional APT tracking models inadequate for assessing the full Iranian cyber posture during the conflict. The apparent coordination may instead reflect convergent targeting doctrine: multiple IRGC-affiliated units independently prioritizing the same sectors without centralized direction, producing an observable pattern indistinguishable from unified command. Wartime operational tempo has almost certainly compressed the OPSEC standards these groups normally maintain, creating a narrow intelligence collection window within the coming weeks as tradecraft degrades under pressure.

1 sources

Resecurity warns that Iran war enters multi-domain phase as cyber and kinetic operations converge - Industrial Cyber