This latest cyber assessment released during the war with Iran mirrors similar cyber intrusions made by an Iran-aligned group that targeted Pennsylvania water systems in late 2023.
Iran-aligned hackers have exploited and disrupted operational technology control systems embedded in multiple U.S. critical infrastructure sectors, targeting equipment manufactured by Rockwell Automation, according to an advisory issued Tuesday.
The hackers have set their sights on the company’s Allen-Bradley line of programmable logic controllers, or PLCs, which are digital computers that interface with operational equipment to monitor and automate industrial processes like water treatment, power generation and manufacturing.
The cyber intrusions have, in some cases, resulted in operational disruption and financial loss, according to the assessment signed by the Cybersecurity and Infrastructure Security Agency, FBI, NSA, EPA, the Department of Energy and U.S. Cyber Command’s Cyber National Mission Force.
The disruptions occurred by manipulating data on human-machine interfaces and on supervisory control and data acquisition, or SCADA, displays, as well as harmful interactions with project files, it adds.
The advisory is the latest signal indicating that Iran-aligned hacker groups have successfully targeted and impeded U.S. systems amid the ongoing U.S.-Israel war against Iran that broke out Feb. 28.
It comes after an apparent Tehran-backed hacker group carried out a cyberattack against medical technology giant Stryker last month, which wiped employees’ phones and prevented workers from accessing their computers.
“The authoring agencies assess a group of Iranian-affiliated advanced persistent threat (APT) actors is conducting this activity to cause disruptive effects within the United States.” the advisory reads. “The group has targeted devices spanning multiple U.S. critical infrastructure sectors, including Government Services and Facilities (to include local municipalities), Water and Wastewater Systems (WWS), and Energy Sectors.”
A request for comment sent to Rockwell Automation’s media relations email bounced back.
Pro-Iran hackers have made a habit of targeting any computer systems tied to nations deemed foreign adversaries by Tehran, especially the U.S. and Israel. In late 2023, amid the Israel-Hamas war, one hacker group defaced the interfaces of water treatment systems in Pennsylvania, which had Israel-made Unitronics equipment built inside.
In 2020, Rockwell Automation acquired Israel-based Avnet Data Security, aiming to bolster the cyber posture of its industrial control systems and operational technology.
The assessment urged organizations to keep PLCs off the open internet, review logs for suspicious activity and lock down affected Rockwell devices to prevent unauthorized access. Unsecured internet-connected operational technology can expose industrial systems to remote access, giving attackers a pathway to disrupt or manipulate functions.
The Iran war has been widely expected to test the strength of U.S. cyberdefenses, and experts have warned that exposed devices would be a potential target for pro-Iran hackers.
President Donald Trump escalated his threats against Tehran on Tuesday, saying a “whole civilization will die tonight” if Iran doesn’t open the Strait of Hormuz by an 8 p.m. ET deadline.
Trump has promised to attack “every bridge” and power station in the country if a deal isn’t reached. Iran has promised a “devastating” response if such an attack occurs. Any sharp escalation could heighten the risk of retaliatory cyberattacks.
Facts Only
Iran-aligned hackers have targeted U.S. industrial control systems, specifically Rockwell Automation’s Allen-Bradley PLCs.
The cyber intrusions have disrupted operations and caused financial losses in multiple U.S. critical infrastructure sectors.
The advisory was issued by CISA, the FBI, NSA, EPA, the Department of Energy, and U.S. Cyber Command’s Cyber National Mission Force.
Disruptions occurred by manipulating data on human-machine interfaces and SCADA displays.
The targeted sectors include government services, water and wastewater systems, and energy.
A previous attack in late 2023 defaced water treatment systems in Pennsylvania using Israel-made Unitronics equipment.
In 2020, Rockwell Automation acquired Israel-based Avnet Data Security to improve cybersecurity for its industrial systems.
The advisory recommends keeping PLCs off the open internet and reviewing logs for suspicious activity.
Former President Donald Trump threatened severe consequences if Iran does not reopen the Strait of Hormuz by a specified deadline.
Iran has warned of a "devastating" response to any U.S. attack.
Executive Summary
Iran-aligned hackers have targeted U.S. industrial control systems, particularly Rockwell Automation’s Allen-Bradley programmable logic controllers (PLCs), which are used in critical infrastructure sectors like water treatment, power generation, and manufacturing. The cyber intrusions have caused operational disruptions and financial losses by manipulating data on human-machine interfaces and SCADA systems. The advisory, issued by multiple U.S. agencies including CISA, the FBI, and the NSA, highlights the involvement of Iranian-affiliated advanced persistent threat (APT) actors aiming to disrupt U.S. infrastructure. This follows previous attacks, such as the late 2023 defacement of Pennsylvania water systems and a recent cyberattack on medical technology firm Stryker. The advisory urges organizations to secure PLCs and review logs for suspicious activity. Meanwhile, geopolitical tensions have escalated, with former President Donald Trump threatening severe consequences if Iran does not reopen the Strait of Hormuz, raising concerns about potential retaliatory cyberattacks.
The situation underscores the vulnerability of exposed industrial control systems and the broader cybersecurity risks posed by state-aligned hackers amid ongoing conflicts. While the advisory provides actionable recommendations, the effectiveness of these measures remains uncertain as threats evolve. The interplay between cyber warfare and geopolitical brinkmanship further complicates the landscape, with both sides signaling readiness for escalation.
Full Take
The strongest version of this narrative highlights a clear and present danger: state-aligned hackers are actively targeting U.S. critical infrastructure, with verifiable disruptions and financial losses. The advisory’s multi-agency backing lends credibility, and the inclusion of specific technical details—such as the manipulation of SCADA systems and PLCs—grounds the threat in tangible risks. The historical context, including prior attacks on water systems and medical technology firms, reinforces the pattern of Iranian cyber aggression. However, the narrative also leans into geopolitical tensions, with Trump’s escalatory rhetoric and Iran’s retaliatory threats framing the cyber conflict as part of a broader, high-stakes confrontation.
Patterns detected: ARC-0024 Ambiguity (the advisory’s broad warnings about "disruptive effects" without quantifying scale or impact), ARC-0043 Motte-and-Bailey (the shift from technical cybersecurity concerns to geopolitical brinkmanship, conflating distinct threats).
The root cause paradigm here is the weaponization of cyber infrastructure as an extension of state power, where digital attacks serve as both tactical disruptions and strategic signaling. The unstated assumption is that cyber warfare is an inevitable byproduct of geopolitical conflict, with critical infrastructure as the battleground. This echoes Cold War-era proxy conflicts, but with digital tools replacing conventional warfare. The implications for human agency are stark: civilians and local municipalities bear the brunt of disruptions, while nation-states engage in high-stakes deterrence. The second-order consequences include eroded trust in digital systems, potential overreach in cybersecurity measures, and the normalization of cyberattacks as a tool of statecraft.
Bridge questions: How might the U.S. distinguish between legitimate cybersecurity preparedness and escalatory rhetoric that could provoke further attacks? What safeguards exist to prevent critical infrastructure from becoming collateral damage in state-sponsored cyber conflicts? Would a de-escalation in geopolitical tensions correlate with a reduction in cyber intrusions, or has the genie already left the bottle?
Counterstrike scan: If this were part of a coordinated influence campaign, the playbook would involve amplifying fears of cyber vulnerability while tying them to existential geopolitical threats, creating a feedback loop of anxiety and retaliation. The actual content partially aligns with this pattern—technical warnings are juxtaposed with Trump’s inflammatory rhetoric—but stops short of outright manipulation. The advisory’s focus on actionable mitigation steps tempers the alarmism, suggesting a primary intent to inform rather than provoke.
Sentinel — Human
The article shows signs of machine generation, such as uniform sentence lengths and overuse of hedging phrases. However, it also contains human-like elements like idiosyncratic emphasis and personal voice. The advisory language suggests a coordinated approach, which could indicate AI assistance or template usage.