Iranian Threat Actors Disrupt US Critical Infrastructure Via Exposed PLCs

Iranian state-affiliated hackers are actively disrupting US critical infrastructure by exploiting Internet-exposed programmable logic controllers, particularly Rockwell Automation devices used in energy, water, and government facilities. According to a joint advisory from CISA and other federal agencies, the attacks have already caused operational disruptions and financial losses through manipulation of control systems and tampering with display interfaces. The campaign, which began last month following joint US-Israel attacks on Iran, underscores the longstanding vulnerability of industrial control systems connected directly to the Internet without proper security measures.