Iranian-affiliated US CNI OT attack campaign
Campaign
Summary
Hide ▲
Show ▼
An Iranian-affiliated campaign is actively targeting US critical national infrastructure providers, creating operational disruption and financial loss across multiple sectors. The operation focuses on internet-facing OT assets, including Rockwell Automation/Allen-Bradley PLCs. It has also involved manipulation of HMI and SCADA displays, raising concerns about control-system integrity. The activity shows a continuing attempt to reach and influence industrial systems rather than a one-off intrusion.
Related Happenings
US government warning on Iran-affiliated critical infrastructure disruption risk
Public Sector Action
H score24
First: 18.05.2026 18:41
Last: 18.05.2026 18:41
Sources 1
About this happening:
The US government warned that Iran-affiliated threat actors were disrupting US critical infrastructure through attacks on Internet-exposed OT devices across mult...
US government warning on Iran-affiliated critical infrastructure disruption risk
Public Sector ActionAbout this happening: The US government warned that Iran-affiliated threat actors were disrupting US critical infrastructure through attacks on Internet-exposed OT devices across mult...
CISA releases CI Fortify guidance for critical infrastructure resilience
Public Sector Action
H score29
First: 05.05.2026 15:00
Last: 05.05.2026 15:00
Sources 1
About this happening:
CISA released CI Fortify, guidance for critical infrastructure operators across sectors to help keep essential services running during cyberattack or crisis conditions. The framew...
CISA releases CI Fortify guidance for critical infrastructure resilience
Public Sector ActionAbout this happening: CISA released CI Fortify, guidance for critical infrastructure operators across sectors to help keep essential services running during cyberattack or crisis conditions. The framew...
Latest development: 06.05.2026 16:15
CISA launched CI Fortify on Tuesday as a planning framework for critical infrastructure operators in water, energy, transportation and communications to prepare for cyber disruption by disconnecting OT systems from third-party and business networks, maintaining essential services in degraded communications conditions, and recovering compromised systems through backups, component replacement, or a transition to manual operations.
CISA-led zero-trust guide for OT environments
Public Sector Action
H score31
First: 30.04.2026 17:00
Last: 30.04.2026 17:00
Sources 1
About this happening:
US government agencies led by CISA released Adapting Zero Trust Principles to Operational Technology, giving OT operators a framework to improve critical infrastruct...
CISA-led zero-trust guide for OT environments
Public Sector ActionAbout this happening: US government agencies led by CISA released Adapting Zero Trust Principles to Operational Technology, giving OT operators a framework to improve critical infrastruct...
Internet-exposed Rockwell Automation/Allen-Bradley PLCs concentrated in the United States
Trend
H score32
First: 10.04.2026 18:52
Last: 10.04.2026 18:52
Sources 1
About this happening:
A measured exposure pattern shows 5,219 internet-facing Rockwell Automation/Allen-Bradley PLC hosts worldwide, expanding the attack surface for industrial control netw...
Internet-exposed Rockwell Automation/Allen-Bradley PLCs concentrated in the United States
TrendAbout this happening: A measured exposure pattern shows 5,219 internet-facing Rockwell Automation/Allen-Bradley PLC hosts worldwide, expanding the attack surface for industrial control netw...
Internet-facing Modbus OT devices with unauthenticated access remain exposed
Trend
H score32
First: 10.04.2026 16:30
Last: 10.04.2026 16:30
Sources 1
About this happening:
Internet-facing Modbus OT devices remain exposed to unauthenticated access, with a scan finding at least 179 devices and highlighting a broader critical-infrastructu...
Internet-facing Modbus OT devices with unauthenticated access remain exposed
TrendAbout this happening: Internet-facing Modbus OT devices remain exposed to unauthenticated access, with a scan finding at least 179 devices and highlighting a broader critical-infrastructu...
Timeline
-
08.04.2026 11:15 2 articles · 3mo ago
Iranian-affiliated US CNI OT attack campaign
Initial DisclosureThe campaign began last month by probing internet-facing OT assets in US infrastructure environments. Early activity centered on gaining controller access and manipulating operational displays, signaling a move from reconnaissance to disruptive control attempts.
Show sources
- Iran‑Backed Threat Actors Hit US CNI Providers via Internet‑Facing OT Assets — www.infosecurity-magazine.com — 08.04.2026 11:15
- Iran‑Backed Threat Actors Hit US CNI Providers via Internet‑Facing OT Assets — www.infosecurity-magazine.com — 08.04.2026 11:15