Iran has always been a formidable cyber threat to the United States, but after the war in Iran commenced, the attacks are coming frequently and in full force. According to the Joint Cybersecurity Advisory issued on April 7, 2026, by the FBI, CISA, NSA, EPA, DOE, and Cyber Command, Iranian-based hackers are targeting operational technology devices connected to the internet, including programmable logic controllers (PLC). The Advisory notes that the PLC disruptions have been seen “across several U.S. critical infrastructure sectors through malicious interactions with the project file and manipulation of data…resulting in operational disruption and financial loss.”
The Advisory states that U.S. organizations “should urgently review the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) in this advisory for indications of current or historical activity on their networks, and apply the recommendations listed in the Mitigations section of this advisory to reduce the risk of compromise.”
If your organization is considered critical infrastructure, it is crucial to review the Advisory, including the indicators of compromise and mitigation techniques.