Government agencies in the United States have issued an urgent warning, alerting critical infrastructure sites to be wary of cyber-attacks from hackers believed to be acting on behalf of Iran. Since March 2026, these advanced persistent threat (APT) groups have been targeting programmable logic controllers (PLCs), essential devices used in industrial automation.

The affected sectors include government services and facilities, waste water systems and energy industries. The hackers' tactics involve operational disruption and financial loss, according to the advisory by multiple agencies including the FBI and Cybersecurity and Infrastructure Security Agency.

Security firm Censys has identified 5,219 exposed PLCs made by Rockwell Automation/Allen-Bradley, with a staggering 75% of them located in the United States. These devices are often placed in remote locations, making them vulnerable to cyber intrusions.

The infrastructure used to target these devices includes a single multi-home Windows engineering workstation running the Rockwell tool chain, indicating the sophistication and persistence of this threat.