Iran-Linked Cyberattack Disrupts UK Power Generation Facility

This advisory, informed by broader OT activity (AA26-097A) and a UK intrusion with an unknown entry, recommends five prioritized defensive actions: remove direct internet exposure of industrial controllers and funnel remote access through secure gateways; monitor engineering workstations, accounts and controller changes with known-good configuration baselines; enforce network segmentation and apply identity and logging controls to third-party/vendor access; monitor for exposed engineering and supplier credentials in breach data and infostealer logs; and maintain and test offline, validated PLC/HMI backups to measure trusted recovery time for industrial processes.