U.S. Agencies Warn of Iran-Linked Cyberattacks on Critical Infrastructure

Six U.S. federal agencies, including the Federal Bureau of Investigation, issued a joint advisory on April 8, 2026, warning that Iran-affiliated threat actors have compromised programmable logic controllers (PLCs) across the United States. The campaign, which began as early as 2025, specifically targeted Rockwell Automation and Allen-Bradley devices in the energy, water, and government sectors. The attackers used leased overseas infrastructure to manipulate SCADA and HMI data, leading to operational disruptions and financial losses. Censys reported that approximately 3,900 vulnerable devices are located in the U.S., accounting for 74.6% of global exposure.

Concurrent with these systemic attacks, the Iran-linked hacking group Handala claimed responsibility for breaching Stryker Corp., a Michigan-based medical device manufacturer, and hacking the personal email of FBI Director Kash Patel. The U.S. government linked this surge in cyber activity to escalating hostilities between the U.S., Israel, and Iran, following February airstrikes that killed Iran's leader.

Despite a two-week ceasefire between the three nations, Handala announced it would continue targeting Israel and only temporarily postpone operations against the U.S. Cybersecurity experts warned that the ceasefire might actually expand the scope of attacks as actors shift focus toward U.S. data centers and defense contractors. Federal agencies have urged organizations to immediately disconnect PLCs from the public internet and implement multifactor authentication to prevent further exploitation.