Adversary Intelligence — 2026-04-26
Pro-Iran Hackers Escalate Critical Infrastructure Cyberattacks Targeting Water, Energy, and Transit Systems
Defense One reported pro-Iran hacking groups have increased attacks on US critical infrastructure since the war began, including disrupting PLCs at water and energy facilities and claiming intrusion into LA Metro systems. Six federal agencies warned that Iranian APT actors are causing operational disruptions.
Analysis
Whether Iranian-affiliated cyber actors successfully disrupt an additional US critical infrastructure system with operational impact within 60 days isgenuinely uncertain , revised from the initial likely assessment. The ensemble stepped down because the compound resolution bar, requiring Iranian attribution, US critical infrastructure target, actual operational disruption rather than PLC defacement, and a 60-day window, is stricter than the reference class captures. Most CyberAv3ngers activity has been low-grade OT message-board modification on Unitronics PLCs that does not clear an operational-impact threshold, and elevated defender posture during the Hormuz conflict depresses success rates. The formal CISA advisory aa26-097a attributing attacks to Cyber Av3ngers targeting Rockwell Automation PLCs represents the first multi-agency attribution since the conflict escalated. Read alongside the CISA staffing story, the attribution arrives when the issuing agency operates at 40 percent capacity.
Whether Iranian-affiliated cyber actors successfully disrupt an additional US critical infrastructure system with operational impact within 60 days is