Adversary Intelligence — 2026-04-15
FDD Analysis Details How Iranian Cyberattack Disabled U.S. Local Government Systems
An FDD analysis published April 14 details how Iranian-affiliated APT actors exploited internet-exposed programmable logic controllers to disrupt water treatment, wastewater, and energy systems across U.S. local governments. The attacks manipulated SCADA displays and degraded PLC functionality as the Iran conflict escalated cyber operations against civilian infrastructure. The analysis builds on a CISA/FBI/NSA joint advisory (AA26-097A) that attributed the campaign to IRGC-linked actors exploiting
Analysis
The six-agency advisory (FBI, CISA, NSA, EPA, DOE, CNMF) is the first wartime product combining IC, law enforcement, and sector regulators in a single attribution, a coordination architecture drawn fromColonial Pipeline lessons. It marks the crossing from Iranian OT reconnaissance into confirmed sabotage: water treatment, municipal services, and energy systems have logged operational disruptions and financial losses, not just network positioning. The advisory's breadth also risks conflating opportunistic scanning of internet-exposed PLCs with IRGC-directed pre-positioned capabilities, a threat inflation risk that matters more during ceasefire de-escalation than it would mid-escalation.
The six-agency advisory (FBI, CISA, NSA, EPA, DOE, CNMF) is the first wartime product combining IC, law enforcement, and sector regulators in a single attribution, a coordination architecture drawn from