Iranian cyber activity hits US energy, water, and government networks

U.S. federal cybersecurity and law enforcement agencies warned that Iranian-affiliated APT actors have been accessing internet-exposed PLCs (including Rockwell/Allen-Bradley devices) using overseas IPs and leased infrastructure, sometimes via legitimate engineering software, to extract project files and manipulate HMI/SCADA displays—causing operational disruptions and financial loss across multiple critical infrastructure sectors. Agencies recommend disconnecting PLCs from public internet access, limiting remote connectivity, enabling programming protections or physical run switches, maintaining backups, and validating/log-reviewing suspicious activity.