Summary

Tehran is likely to increase its cyberattacks on American infrastructure, which the United States must prepare for on a new front in the Iran war, a former White House adviser has told Newsweek. The warning by former acting Principal Deputy National Cyber Director Jake Braun comes as tensions between the U.S. and Iran are expected to spike more after Washington announced new “D-Day” sanctions punishing those who do business with the Islamic Republic. Braun, who served in the Biden administration, has long warned that U.S. water utilities, of which there are around 150,000, are at risk from Iranian hackers. Reports last week that Iranian hackers had temporarily shut down a British power plant follow Tehran-linked hackers recently targeting water systems across the U.S. Braun, now executive director of the Cyber Policy Initiative at the University of Chicago Harris School of Public Policy, said that the reported attack on the British power plant signaled Tehran’s intent. “It shows that hacking civilian critical infrastructure is now a constant dimension of war and America needs to be ready for attacks like this to continue and increase in severity.” Newsweek reached out to the Iranian Foreign Ministry for comment. CISA Issues Warning About Iran Threat The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of cyberattacks on critical infrastructure by hackers linked to Iran's Islamic Revolutionary Guard Corps (IRGC). U.S. officials suspect Tehran was behind the targeting of U.S. water systems in at least a dozen states, including New Jersey, Minnesota, Georgia and South Dakota. Minnesota officials have not publicly attributed the attacks, although news outlets, citing U.S. officials and a leaked industry threat-sharing memo, reported Tehran was to blame. President Donald Trump has rejected this. It places civilian infrastructure as another front in the Iran war, with small and lightly defended water and energy facilities offering hackers a way to cause disruption without penetrating a major power grid or striking a military target. “If you're the Iranians, the lowest hanging fruit unfortunately is water, because it's most critical to human life and least protected,” said Braun. “This is to send a message that they can undermine public trust in the government to provide basic services when the country is already deeply divided over this war.” Components called programmable logic controllers (PLCs) turn equipment on and off and are often connected to the internet, allowing hackers to access their functions, the CISA said in a July 30 notice. CISA reported earlier in April that Iranian-linked actors are using simple techniques like scanning for exposed devices and exploiting default credentials rather than sophisticated exploits of holes companies may not know exist. CISA also said individual plant operators are largely responsible for securing equipment, but often small utilities have few to no dedicated cybersecurity staff for devices that were never built with security as a priority. Braun co-founded DEF CON Franklin to mobilize volunteer cybersecurity experts to defend water systems with free support for local providers and technology firms, such as help changing default passwords and enabling multifactor authentication. “Congress absolutely should be funding a solution to this,” said Braun. “One of the things that's probably most at risk for America right now is that civilian water utilities support nearly all of our military installations or our military assets. “That is a clear national security threat and therefore Congress needs to step up and fund a solution.” Braun oversaw the implementation of the National Cybersecurity Strategy. Until then, he said most hacks involved nation-state pre-positioning, like China or espionage and hacktivism by Russia. “But we didn't have a nation state shutting off the water anywhere or trying to shut off the water and attacking OT (operational technology) systems," he said. Artificial intelligence makes this possible much faster because it can scan tens of thousands of utilities at once to see which do not have their security configuration set up correctly, he said. “These countries know that there is no way they could ever invade the United States and win, so what they're trying to do is to make us tear ourselves apart from within.” Iran’s Global Reach Tehran had already been accused of prior global cyberattacks, being linked to a power outage in Turkey in 2015 and possible breaches of Israeli government websites in 2022. The Iran-linked hackers suspected of forcing a small British power generator offline did so for four days last month, according to The Telegraph. The hacking unit linked to the IRGC known as CyberAv3ngers was behind the attack, the Financial Times reported. Neither the British government nor the National Cyber Security Centre would give further details about the affected site, but the United Kingdom's Department for Energy Security and Net Zero (DESNZ) said the incident affected a small-scale generator and posed no risk to the wider energy system. U.K. Energy Minister Michael Shanks said in a statement that “there was no threat to the wider grid and nobody lost power." However, Graeme Stewart, head of public sector at cybersecurity firm Check Point, said the U.K. attack “marks a grave escalation in the Iran conflict.” “We have to ask what happens if the next target is bigger, more critical or more deeply connected to the services millions of people rely on,” he told Newsweek. “If this attack was intended to demonstrate that Iranian-linked hackers can penetrate UK infrastructure and cause real-world consequences, then the significance isn't measured by the size of the generator they managed to shut down, but by what they have demonstrated may be possible.” Contact Newsweek editors on this story: Matthew Robinson and Sam Wilson.