Iran Cyber Risk Climbs as US Resumes Strikes on Critical Infrastructure
Following U.S. strikes on Iranian rocket launchers, federal warnings highlight increased cyber risk to American critical infrastructure, with Iranian-linked actors historically probing energy and water systems after kinetic escalations.
The recent exchange of strikes between the United States and Iran has reignited concerns over cyberattacks targeting American critical infrastructure. U.S. forces conducted strikes on Iranian rocket launchers on Larak Island, which were reportedly preparing to fire rockets carrying sea mines into the Strait of Hormuz. Iran retaliated with ballistic missiles and explosive drones targeting bases in Jordan and the United Arab Emirates, ending a monthlong lull in the ongoing conflict.
This kinetic escalation has historically preceded waves of cyber intrusions against U.S. utilities. Federal advisories from agencies including CISA, the FBI, and the NSA have frequently warned about Iranian-linked probing of industrial control systems shortly after missile exchanges. Iranian state-sponsored hacking groups have also often claimed responsibility for cyber operations following such kinetic events.
In April, federal agencies issued a warning about Iranian-linked actors exploiting internet-facing programmable logic controllers and misconfigured operational technology across U.S. critical infrastructure. This advisory was expanded in July to include specific vendor equipment from Siemens, Schneider Electric, and Rockwell Automation, just days before a significant surge in reported intrusions.
A coordinated campaign on July 26-27 disrupted operational technology at over 30 community water systems in Minnesota, forcing utility operators to revert to manual operations. CISA later confirmed observing more than 100 internet-exposed water systems targeted throughout July. A joint alert from the FBI and EPA on July 30 indicated that water systems in at least seven states had reported incidents since July 27, with some disruptions affecting water operations.
Analysts characterize recent Iranian cyber activity as a hybrid threat, combining physical destruction with network intrusions, often with unpredictable targeting. Threat intelligence firm RedSense described Tehran's approach as "threat projection," suggesting that Iranian cyber operations carry an outsized political impact relative to their technical sophistication.
A group identifying as APT IRAN, which security researchers link to the IRGC-affiliated CyberAv3ngers, issued a statement on Sunday warning of "disruptive events" in the energy, water, and telecommunications sectors. This group had previously claimed responsibility for the July water system attacks, framing them as a warning. While the group claimed only six states were affected, federal officials have reported potential intrusions at utilities across nearly a dozen states.
Federal agencies have not publicly attributed the July water campaign to a specific named group, and CISA and the FBI have declined to comment on attribution for recent attacks on U.S. water and critical infrastructure. The U.S. operates over 150,000 water systems, many of which are managed by small municipalities lacking dedicated cybersecurity staff, making them particularly vulnerable to such persistent threats.