ConflictClarifier

متتبع أزمة إيران-الخليج 2026
CC
Events Archive
strikeApr 7, 2026

Iran attempting cyber attacks against U.S. critical infrastructure, officials say

Summary

Iran attempting cyber attacks against U.S. critical infrastructure, officials say - - Click here to listen to this article - Share via - Tehran’s targeting campaigns against U.S. organizations ‘have recently escalated,’ a federal advisory warns. - Iran has demonstrated an ability to penetrate networks tied to critical U.S. infrastructure before. WASHINGTON — U.S. intelligence agencies are “urgently warning” private sector companies throughout the nation that Iranian actors “are conducting exploitation activity” that has resulted in “disruptions across several U.S. critical infrastructure,” according to a government notice reviewed by The Times. The Iranian cyberactivity comes as President Trump is threatening to target Iran’s critical infrastructure in the coming hours, particularly its bridges and power plants. Iran’s attack targeted products by Rockwell Automation’s Allen-Bradley, one of the most widely used industrial automation brands, according to the notice, which said that cyber actors affiliated with Iran were exploiting “programmable logic controllers across U.S. critical infrastructure.” Tehran’s targeting campaigns against U.S. organizations “have recently escalated, likely in response to hostilities between Iran and the United States and Israel,” the notice warned. “Iran-affiliated advanced persistent threat (APT) actors are conducting exploitation activity targeting internet-facing operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley,” the notice reads. “U.S. organizations should urgently review the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) in this advisory for indications of current or historical activity on their networks,” it continues. The advisory was issued Tuesday jointly by the FBI, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, the Environmental Protection Agency, the Department of Energy, and Cyber Command. The extraordinary threat signaled Trump’s willingness to authorize U.S. military strikes on Iranian infrastructure if no ceasefire deal is reached by 5 p.m. PDT Tuesday. Top executives from companies at the core of the nation’s ability to function — those leading America’s largest energy, water, transportation, and communications corporations — had already been taking it upon themselves to increase their vigilence over potential attacks, concerned that Trump’s willingness to target Iran’s critical infrastructure inadvertently put a mark on their backs. Some fear Iran’s ability to conduct cyber operations that could take down transformers or power inverters, if not a wide-scale power system. Others are concerned by threats to brick and mortar sites from proxies of Tehran — physical attacks against facilities such as nuclear plants, or power management systems, the crown jewels of the sector. Larger, even more capable actors, particularly Russia and China, may also take advantage of the fog of war to launch strikes themselves. “There remains concern about Iranian cyber capabilities and retaliation if the U.S. carries through on threats to attack their infrastructure,” said Ernest Moniz, former U.S. secretary of energy under President Obama who helped negotiate the 2015 nuclear deal with Iran. “There may already be backdoors, Trojan horses and malware hidden in our infrastructure.” “I have to believe that the government cyber experts — or what’s left of them — are working closely and indeed overtime with the power companies and other infrastructure operators on cyber defense and intrusion detection and warning,” Moniz added. Iran has demonstrated an ability to penetrate networks tied to critical U.S. infrastructure before. In 2015, Iran-backed hackers accessed data associated with Calpine Corp., one of California’s largest power producers, obtaining detailed engineering diagrams and credentials related to power plant systems. Some were labeled “mission critical.” U.S. officials feared at the time that the breach would allow Tehran to initiate blackouts nationwide. Since that time, companies at the center of the U.S. energy and telecommunications sectors have markedly improved their defenses. But Iran’s offensive capabilities have improved, as well. Large players in the energy sector are operating with “a watchful eye and an elevated posture right now,” said Pedro J. Pizarro, president and chief executive officer of Edison International, the parent company of Southern California Edison, one of the nation’s largest electric utilities. Companies like Edison have been operating under persistent threat for over a decade. In 2024, a pair of devastating cyberespionage attacks targeting U.S. critical infrastructure attributed to Chinese hackers, Volt Typhoon and Salt Typhoon, were discovered after avoiding detection for at least three years. The threat of a similarly latent attack — where malware lies dormant in critical infrastructure systems, waiting for a signal to activate — is a real cause for concern in the sector, despite its best efforts and technological advances, experts and insiders said. “The threat of cyber and physical attacks targeting critical infrastructure is not new,” said Jennifer DeCesaro, senior vice president of industry operations at the Edison Electric Institute, “which is why we partner with the government through the Electricity Subsector Coordinating Council to share actionable intelligence and prepare to respond to incidents that could affect our ability to provide electricity safely and reliably.” The ESCC works closely with the National Security Council and its intelligence arms, particularly the intelligence agencies and CISA, to coordinate regular briefings on safety standards, best practices and intelligence tips. The CIA declined to comment. A spokesperson with CISA, listed as out of office due to the ongoing federal funding hiatus for the Department of Homeland Security, could not be reached for comment. Last summer, announcing a 40% cut to the workforce of her office, Director of National Intelligence Tulsi Gabbard eliminated the Cyber Threat Intelligence Integration Center, previously seen as a critical fusion hub of information by private sector partners. While the loss of capacity from the Middle Eastern carriers has reduced long-haul flying overall, Western airlines are moving in to fill the gap. Asked to respond to the potential of retaliatory attacks against U.S. infrastructure, Karoline Leavitt, the White House press secretary, repeated the president’s threats. “The Iranian regime has until 8PM Eastern Time to meet the moment and make a deal with the United States,” she said. “Only the president knows where things stand and what he will do.” Trump has threatened to destroy every bridge and power plant in Tehran if they fail to come to an agreement that ends its control over the Strait of Hormuz. Ultimately, corporate executives shoulder much of the burden as the first line of defense for the country’s critical infrastructure, roughly 85% of which is owned by private sector companies. Tom Fanning, former CEO of Southern Co. and now executive committee chairman at the Alliance for Critical Infrastructure, said the threat from Iran is “credible.” “I have not seen what I would describe as the existential threat, to take down a wide-ranging power system,” Fanning said. “Could those things be turned on? Sure. Is the United States critical infrastructure prepared to act? I think so.” Last month, early on in the war, the Los Angeles Metro transit system was forced to shut down a portion of its network due to a hack. Authorities say it is still unclear who was behind the breach, but a source told The Times that Iran-backed hackers are being investigated as the potential culprit. The transportation agency said its security team had “discovered unauthorized activity,” and were making sure its roughly 1,400 servers were secure before bringing them back online. The agency has emphasized the hack did not impact passengers’ commute time. The FBI said it was aware of the hack. DHS is working with local partners “to address cyber threats to critical infrastructure,” an official said. “The reality is that the threats are here and now,” Fanning added. “The truth is, the bad guys are already here.” Times staff writers Kevin Rector, Richard Winton and Rebecca Ellis, in Los Angeles, contributed to this report.

Actors involved

USIsraelIranUNRussiaChina

Sources

  • Michael WilnerBy Michael Wilner

    Iran attempting cyber attacks against U.S. critical infrastructure, officials say - - Click here to listen to this article - Share via - Tehran’s targeting campaigns against U.S. organizations ‘have recently escalated,’ a federal advisory warns. - Iran has demonstrated an ability

See this event through different lenses

Compare how Western, Iranian, Israeli, Global South, and Pro-Peace perspectives frame this event.

Compare Perspectives

Community Notes

Community Notes

Loading notes...

Related events

strikeUnverifiedUSIsraelIranUN
1 source

The US and its allies Britain, France and Germany are pushing other countries on the UN nuclear watchdog's board to pass a resolution next week reporting Iran to the UN Security Council for the first time in 20 years, diplomats said on Friday. If passed, the resolution would follow up on one adopted on June 12 of last year declaring Iran in breach of its non-proliferation obligations for not fully cooperating with an investigation into uranium traces found at undeclared sites.

The US launched an air war against Tehran on February 28 in which, together with Israel, it destroyed or badly damaged Iran's uranium-enrichment facilities. Iran has not let International Atomic Energy Agency (IAEA) inspectors return to the bombed sites since then or verify what remains of its stocks of enriched uranium, some of which was enriched to up to 60% purity, a short step from weapons grade.

Resolution would be culmination of standoff over IAEA's access to nuclear sites A resolution by the IAEA's 35-nation board reporting Iran to the Security Council would also be the culmination of a standoff over IAEA access to those sites, since the board has passed two resolutions in the past year demanding Iran declare its enriched uranium stocks and grant the IAEA full access to verify them.

A draft text for the resolution has yet to be formally submitted to the board and negotiations between countries over the exact wording are ongoing, diplomats said. A draft is usually formally submitted early in the week of a board meeting. As a party to the nuclear Non-Proliferation Treaty (NPT), Iran has the right to develop nuclear technology, including enrichment, for peaceful purposes.

Iran says it would never produce nuclear weapons. It is, however, the only country to enrich to 60% without making a bomb. The amount it has enriched to that level is "a matter of serious concern" to the IAEA. The IAEA believes well over 200 kg of that highly enriched uranium has survived the bombardments and is held in a tunnel complex at Isfahan and at the Natanz facility.

Location: Jerusalem
strikeUnverifiedUSIranChina
1 source

The U.S. Treasury imposed sanctions on the Turkish bank Golden Global Yatirim Bankasi Anonim Sirketi, alleging it facilitated the transfer of Iranian oil revenues into cash and gold. Treasury Secretary Scott Bessent stated these measures are part of "Operation Economic Outcast," an initiative launched following more than six months of conflict to pressure Iran.

Location: Iran
strikeUnverifiedUSIsraelIranEURussiaChinaUkraineHamas
1 source

Rabobank reported that geopolitical developments, including Russian statements regarding potential peace talks in Ukraine and US-Iran hostilities, continue to dominate market sentiment, though analysts noted these claims remain unverified. The bank also cited unconfirmed reports that South Korea may deploy forces to the Strait of Hormuz and that Israel has stated regime change in Tehran is a primary objective, while noting that Ukrainian media reports of an impending northern Russian offensive lack independent verification.

Location: Tehran
strikeUnverifiedUSIsraelIranRussiaUkraine
1 source

The White House is now apparently using Russian tactics to convince the American public that the war in Iran is not, in fact, a war. When asked by reporters at the White House on Thursday whether the most intense sustained air campaign by American forces since the invasion of Iraq would be over by the midterms, Vice President JD Vance replied: “I wouldn’t call it a war.

” Vladimir Putin said much the same thing when he invaded Ukraine. Russia was not fighting a war either, the Kremlin insisted; it was merely conducting a “special military operation.” If that comparison strikes you as shocking, consider the contours of the two conflicts.

A vastly more powerful military launched a punishing offensive against a smaller, less well-equipped adversary, inflicted enormous damage without achieving a decisive resolution, and then found itself drawn into a longer, grinding conflict with no clear way out.

The motivations behind the wars may be different, and they’re playing out in different theaters, but the pattern is eerily similar. Now, so too is the attempt by those in power to control how the public understands, and even what it is allowed to call, the obvious war unfolding in front of them.

If This Isn’t a War, What Is? Let us take a moment to assess what exactly has happened since February 28, when the U.S. launched Operation Epic Fury. The opening U.S.-Israeli attack killed Iran’s supreme leader, Ali Khamenei, along with the commander of the Revolutionary Guard, the defense minister and various other senior officials.

According to the U.S. military’s own accounting, the first 38 days of major combat operations involved more than 10,200 sorties and 13,500 strikes. U.S. Central Command (CENTCOM) says those attacks damaged or destroyed more than 85 percent of Iran’s ballistic missile, drone and naval defense industrial base, while knocking out 82 percent of its air-defense missile systems.

The U.S. sent carrier strike groups and warships into the region, later imposing a military blockade on Iranian ports. Meanwhile, American and allied air defenses intercepted more than 6,000 Iranian attack drones and 1,500 ballistic missiles fired at U.

S. forces, Israel and American partners across the Middle East. More than 50,000 U.S. service members remain deployed across the region. The fighting has killed 18 U.S. service members and at least 8,000 people across Iran, Lebanon, Israel and the Gulf states.

More than 750 U.S. service members have been wounded. Last month, during a lull in the fighting, the U.S. Treasury unveiled a sanctions package likened to an “economic D-day” that is designed to make Iran an “economic outcast” and cut the adversary off from all available forms of economic support.

In the announcement, Treasury Secretary Scott Bessent openly declared that Iran had been “at war against America” for 47 years. This week, the shooting resumed; the U.S. hit targets in and around the Strait of Hormuz, and Iran blasted missiles at targets in Kuwait, Bahrain, Jordan and Iraq.

All this from an administration that almost exactly a year ago launched a rapid rebrand of the Defense Department into the “Department of War”. No boots on the ground, though, so it’s not a war, right? Tell It Kind of Like It Is Even the very best snake-oil salesman would have a hard time convincing people that the war in Iran isn’t a war.

So why is JD Vance even trying? Well, if there’s one thing politicians understand better than anyone, it’s the importance of language and rhetoric. Words have immense power; a well-written speech can unite millions of people, and a catchy slogan like Make America Great Again can come to represent an entire political philosophy.

But war is a pesky word. For one, it implies there will eventually be a winner and a loser. It also brings with it certain expectations—and some very difficult questions. What is the objective? How many people will die? When will it end? And, perhaps most dangerously of all: was it worth it?

Those are not questions the White House wants Americans to be asking. Trump built a substantial part of his political identity around ending, rather than beginning, America’s “endless wars.” When Washington and Tehran signed a memorandum of understanding in June, the White House presented it as proof that Trump’s America First approach could deliver peace without another prolonged Middle Eastern conflict.

Then the hostilities started again. Earlier this week, Trump shared a Truth Social graphic declaring that “Hormuz Oil Volumes are BACK!”, saying 18 million barrels a day were once again leaving the Strait, compared with 20 million before the war. No independent commodity tracking company or energy analyst appeared to verify Trump’s claims.

But most Americans won’t be checking tanker-tracking dashboards. What they’ll care about is the cold, hard fact that diesel hit a new record price this morning, soaring to an average of $5.85 a gallon for the first time ever. Gasoline is $4.15 a gallon on average, compared with $3.

20 at this time last year, according to AAA. The numbers on the sign at the gas station and the price on the grocery receipt aren’t affected by Trump’s tall tales, but they’ll surely affect how Americans vote at the midterms. When viewed in this light, Vance’s attempt to discourage reporters from “call[ing] it a war” begins to make sense.

A war is something that we want to end. It tends to result in a winner and a loser. And its worth is up for debate at all times. A different kind of engagement that doesn’t quite meet the threshold of war—say, a special military operation—is not exposed to the same kind of scrutiny.

Vance effectively made that case himself. “When you ask, ‘When will this end?’ You’re asking me a question like, ‘When will the Iranians stop shooting at ships?’” he said. By that logic, there is no American war—only recurring Iranian provocations that require American military responses.

That’s exactly the logic applied by Putin to Ukraine and supposed expansion of NATO. Putting the Toothpaste Back in the Tube U.S. lawmakers have repeatedly invoked the War Powers Resolution to challenge Trump’s authority to keep fighting Iran without specific congressional authorization.

The law generally gives a president 60 days after U.S. forces enter “hostilities” to secure congressional approval or bring those hostilities to an end. That makes the pauses in fighting hugely important. When the original 60-day deadline arrived in May, Trump told Congress that the temporary ceasefire reached in April meant the hostilities that began on February 28 had ended.

Defense Secretary Pete Hegseth argued that the War Powers clock could “pause, or stop” when the shooting did. That position is disputed by legal experts, but its political utility is obvious. If every new outbreak of fighting can be treated as a separate skirmish, rather than part of one continuous war, the administration can argue that a fresh 60-day clock starts each time.

Vance’s insistence that there is no continuing “war” fits neatly for an administration that has already tried to divide six months of conflict into separate periods of hostilities, interrupted by ceasefires and pauses. This brings us back to Moscow.

The Kremlin’s own linguistic trick was also about making one sprawling war sound smaller, more limited and more manageable than it really was. From the very beginning of the invasion, Putin described the war as a special military operation. Only after two years of grinding warfare did Kremlin spokesman Dmitry Peskov openly declare Russia to be in a “state of war”—and even then, he said the transformation had occurred because the “collective West” had joined the fight against Russia.

Vance is playing a similar game, but in reverse. Only now—with soaring fuel prices, mounting casualties, concerns over the military’s munitions stockpiles, and midterm elections on the horizon—is the conflict no longer a war. You can’t put the genie back in the bottle, though, and the American people aren’t stupid.

Vance and the White House may discover in November that voters are perfectly capable of recognizing a war, even when the vice president doesn’t want to call it one.

Location: Iran