A sophisticated Iranian cyber campaign has set its sights on thousands of internet-exposed industrial control systems across the United States, raising urgent questions about the security of America's critical infrastructure. Recent intelligence reveals that state-backed hackers have successfully targeted programmable logic controllers (PLCs) manufactured by Rockwell Automation, affecting operations and causing financial damage to multiple organizations.
The Scale of Exposure
The scope of vulnerable infrastructure is staggering. Security researchers have identified over 5,200 internet-exposed Rockwell Automation and Allen-Bradley devices worldwide, with the United States accounting for nearly three-quarters of this exposure. This translates to approximately 3,900 vulnerable devices on American soil—a massive attack surface that Iranian operatives are actively exploiting.
What makes this situation particularly concerning is the deployment pattern of these devices. A significant portion of the exposed systems operate on cellular carrier networks, indicating they are field-deployed devices using cellular modems. This configuration suggests these controllers manage remote infrastructure assets, potentially including water treatment facilities, power generation systems, and manufacturing operations.
Anatomy of the Attack Campaign
Federal agencies have confirmed that Iranian-affiliated advanced persistent threat (APT) groups have been systematically targeting these industrial systems since March 2026. The timing appears deliberate, coinciding with escalating tensions between Iran and both the United States and Israel.
The attackers have demonstrated sophisticated operational technology knowledge, successfully extracting device project files and manipulating data displayed on human-machine interfaces (HMI) and supervisory control and data acquisition (SCADA) systems. This level of access represents a significant compromise, as it allows adversaries to understand system configurations and potentially disrupt industrial processes.
The ability to manipulate SCADA displays creates dangerous scenarios where operators may receive false information about system status, potentially leading to incorrect decisions during critical operations.
Pattern of Escalation
This campaign represents an escalation in Iranian cyber warfare tactics against US infrastructure. The current offensive builds upon previous operations, including the CyberAv3ngers group's attacks on Unitronics operational technology systems between 2023 and 2024. During those earlier campaigns, Iranian hackers compromised at least 75 PLC devices, with half targeting water and wastewater treatment facilities.
More recently, the Handala hacktivist group—linked to Iran's Ministry of Intelligence and Security—demonstrated their destructive capabilities by wiping approximately 80,000 devices from a major US medical equipment manufacturer's network. This progression from reconnaissance and disruption to data destruction signals increasingly aggressive Iranian cyber operations.
Technical Vulnerabilities
The success of these attacks highlights fundamental security gaps in industrial control system deployments. Many organizations have connected critical operational technology directly to the internet without adequate security controls, creating opportunities for remote compromise.
The attackers are exploiting the EtherNet/IP protocol, which these devices use for communication. Without proper network segmentation and access controls, these systems become accessible to any threat actor capable of identifying and exploiting their vulnerabilities.
Geographic Distribution of Risk
The concentration of vulnerable devices in the United States creates a strategic advantage for Iranian operators. With nearly 4,000 exposed systems, attackers can conduct widespread reconnaissance, identify high-value targets, and potentially coordinate simultaneous attacks across multiple sectors.
Key Takeaways
Organizations operating industrial control systems must take immediate action to reduce their exposure:
Strategic Implications
The Iranian campaign against US industrial infrastructure represents more than isolated cyber incidents—it signals a strategic shift toward targeting the operational technology that underpins American economic and national security. As geopolitical tensions continue to escalate, the cybersecurity community must recognize that industrial control systems have become legitimate targets in modern warfare.
The challenge extends beyond technical vulnerabilities to encompass the fundamental architecture of industrial networks. Many critical systems were designed during an era when internet connectivity was not anticipated, leaving them inherently vulnerable to modern cyber threats.
Organizations must move beyond reactive patching to implement comprehensive operational technology security programs that treat these systems as potential targets rather than isolated industrial equipment. The stakes are too high, and the adversaries too sophisticated, for anything less than a complete transformation in how we secure America's industrial backbone.
