US Warns That Iranian Hackers Are Targeting Water, Energy Sectors

Last updated: 2026/04/07 at 6:23 PM

News Room Published 7 April 2026

As the US-Iran war simmers, the FBI and the NSA are raising alarm bells about Iranian hackers targeting US critical infrastructure, especially services related to water, energy, and local municipalities.

The agencies today issued a joint alert about Iranian hackers working to exploit vulnerable programmable logic controllers (PLCs) in industrial processes to attack various sectors.

The alert suggests that Iranian hackers have already achieved some success in targeting industrial IT systems as recently as last month. “These attacks have led to diminished PLC functionality, manipulation of display data and, in some cases, operational disruption and financial loss,” the FBI said without elaborating.

Specifically, the hackers are targeting PLCs from Rockwell Automation, which also owns the Allen Bradley brand. The company describes its logic controllers as rugged industrial computers “designed to automate manufacturing processes, machinery, and robotic systems.”

However, the US alert indicates that, in some cases, the PLCs have been configured to be publicly accessible on the internet without any safeguards. The Iranians are seizing on the access by using Rockwell Automation’s programming software, such as Studio 5000 Logix Designer, to “create an accepted connection to the victim’s PLC. Targeted devices include CompactLogix and Micro850 PLC devices.”

The attacks follow an earlier suspected Iranian hacking campaign from a group called the CyberAv3ngers, which also targeted PLCs and gained remote access to IT systems at a water provider in Pennsylvania in 2023.

Recommended by Our Editors

The US agencies issued the alert to urge critical infrastructure to shore up their defenses and harden security around their industrial control systems. The alert also notes that the Iranians have recently been using eight IP addresses to conduct the hacks, seven of which were associated with the Iranian attackers in January 2025.

The FBI has also been fighting a hacktivist group called Handala, which federal investigators say is actually an Iranian operation designed to spread propaganda. Handala recently infiltrated a US medical equipment provider called Stryker, wiping thousands of IT systems and employee devices. The group also broke into the Gmail account of FBI Director Kash Patel and stole his personal photos.