Why Iran-Linked Hackers Keep Targeting US Energy Providers

What happened

On July 22-23, 2026, the FBI, CISA, the NSA and the Department of Energy updated a joint advisory warning that Iranian-affiliated hackers are actively breaking into programmable logic controllers (PLCs) at U.S. water, energy and government-facility sites, manipulating displays and, in at least one case, disabling the logic that governs safety shutdowns and alarms 89. TechCrunch and CyberScoop-style trade coverage both describe the update as an escalation of an alert first issued earlier in the year, now expanding beyond Rockwell Automation/Allen-Bradley controllers to include Schneider Electric and Siemens equipment 910. Wired put the advisory in the context of an active shooting war, noting it landed as President Trump was threatening to demolish Iranian infrastructure, and framed the hacking campaign as a form of reciprocal sabotage 17.

According to the advisory, the attackers used leased, foreign-hosted infrastructure and legitimate vendor engineering tools — Rockwell's Studio 5000 Logix Designer, Schneider's EcoStruxure Control Expert, and Siemens' TIA Portal — to connect to misconfigured, internet-exposed controllers, then downloaded, altered or deleted project files 8. In at least one victim environment, the FBI found that attackers had preserved a controller's normal ladder logic while quietly overriding the instructions responsible for safe operating parameters, potentially letting a system enter unsafe conditions without alerting the operator 89. The agencies said the activity has caused operational disruption and financial losses at multiple organizations but did not name victims or quantify the damage 1017.

The technical opening: exposed controllers, not exotic exploits

The recurring theme across the technical writeups is that these intrusions don't require breakthrough hacking skill — they require an internet-facing device that should never have been reachable in the first place. Cybersecurity Dive and Tenable both trace the newer campaign to CVE-2021-22681, a five-year-old authentication bypass in Rockwell's Logix controller ecosystem tied to an insufficiently protected cryptographic key, added to CISA's Known Exploited Vulnerabilities catalog in March 2026 after confirmed exploitation 1014. SecurityWeek reported that around 6,000 Rockwell devices were visible on Shodan when the flaw was first flagged as exploited 13, while a later Censys analysis cited by Tenable counted 5,219 internet-exposed Rockwell/Allen-Bradley hosts globally, nearly 75% of them in the United States 14. The precise numbers move depending on scan date and methodology, but the pattern is consistent: thousands of industrial controllers sit reachable from the open internet.

This is a direct echo of the earlier, better-documented CyberAv3ngers campaign against Unitronics PLCs. CISA's advisory on that episode found the group compromised at least 75 devices, including at least 34 in U.S. water utilities, between November 2023 and January 2024, exploiting default or missing passwords on devices sitting on a predictable default port 1215. That campaign's most-cited incident, the defacement of a controller at a water authority near Aliquippa, Pennsylvania, forced the utility onto manual operations even though officials said drinking water was never at risk 1720.

From defacement to sabotage

Multiple outlets trace an evolution in tactics. Wired describes the group moving from what looked like anti-Israel graffiti on HMI screens toward deeper manipulation of ladder logic capable of disrupting real service, citing both Dragos and Claroty's tracking of water utilities affected in the U.S., Israel and Ireland 1720. Claroty's own research documented a malware platform called IOCONTROL, pulled from a compromised fuel-management system, that the firm ties to the same Iran-linked actors and describes as built for both OT and IoT devices 16. Wired reported that the FBI ultimately seized the IOCONTROL command-and-control server around the same time Claroty published its findings 20.

Dragos's 2025 OT/ICS threat report adds a broader industry lens, identifying a group it calls Bauxite — which it says shares significant technical overlap with CyberAv3ngers — as one of two new threat groups active that year, alongside a separate Russia-linked group called Graphite focused on Eastern European and Middle Eastern energy and government targets 18. That report frames the Iran-linked activity as part of a wider trend of nation-state actors gaining deeper footholds in industrial networks rather than stopping at reconnaissance 18.

Attribution and the accountability response

The U.S. government's formal response predates the 2026 advisory. In February 2024, Treasury's Office of Foreign Assets Control sanctioned six officials of the IRGC Cyber-Electronic Command over the Unitronics hacking campaign, and the State Department has offered a $10 million bounty tied to identifying members of the group 19161720. Treasury's statement at the time noted that the Unitronics operation itself hadn't disrupted critical services but warned that unauthorized access to such systems could still produce serious consequences 19.

Wired's profile of CyberAv3ngers cautions against taking the group's own claims at face value, noting it operated under a hacktivist-style brand and made some exaggerated or fabricated claims — including a supposed Israeli grid blackout that researchers found no evidence for — even as its documented intrusions into Unitronics and other PLCs were real and consequential 20. That same reporting frames the group as one side of a tit-for-tat cyber conflict with the Israel-linked Predatory Sparrow group, which has carried out its own attacks on Iranian gas stations and a steel mill 20.

Where the reporting agrees

Across CISA's advisories, TechCrunch, Cybersecurity Dive, Wired and SecurityWeek, the core facts line up closely: Iranian-affiliated actors have been exploiting internet-exposed PLCs — first Unitronics devices, then Rockwell, and now also Schneider Electric and Siemens equipment — across water, energy and government-facility networks, using legitimate engineering software and weak or absent authentication to alter project files, tamper with displays and, in some cases, undermine safety logic 891017. All of these sources also agree the U.S. government has not named specific victims or put a number on financial losses, describing the impact only in general terms as disruption and cost 91017.

Where it doesn't

The reporting diverges most clearly on scale and immediacy. NBC News, citing four sources with access to government and industry threat data, reported that Iranian hackers had also probed U.S. telecommunications networks and broader infrastructure in recent weeks, but said those attempts had not yet produced confirmed operational damage 11. That's a materially softer claim than the CISA advisory's language about confirmed PLC disruption and financial loss at multiple organizations 89 — one describes attempted, unsuccessful intrusions across a wider set of sectors, the other describes completed compromises with measurable consequences in a narrower, OT-focused set of targets.

There's also inconsistency in exposure counts that outlets don't reconcile: SecurityWeek's roughly 6,000 exposed Rockwell devices via Shodan and the 5,219 figure Tenable drew from Censys data are simply different scans at different times using different search engines 1314 — useful as evidence of scale, not as a precise inventory. And naming itself is unsettled: the same actor set is referred to as CyberAv3ngers, the Shahid Kaveh Group, Bauxite (Dragos), and reportedly other aliases by different trackers, with CISA's advisories declining to formally attribute the 2026 PLC campaign to a single named group even while noting its similarity to CyberAv3ngers' earlier work 81718.

On balance, the weight of technical evidence — CISA's own advisory language, Dragos and Claroty's independent malware analysis, and Treasury's sanctions rationale — supports treating the PLC intrusions as real, ongoing and capable of producing localized but genuine physical-system disruption, not mere propaganda. The NBC account of broader, unsuccessful probing against telecom and other infrastructure should be read as a signal of expanding intent rather than evidence that a wider blackout-scale attack has already succeeded; nothing in the record supports that stronger claim.

Why it matters

The throughline connecting the Aliquippa defacement, the Rockwell exploitation and the IOCONTROL malware is not technical sophistication so much as sheer availability of targets. PLCs were built to run physical processes reliably, not to withstand hostile traffic from the open internet, and thousands of them are reachable anyway. That gap — old equipment, convenience-driven remote access, uneven patching — gives a state actor with modest resources a way to manufacture real-world friction and political leverage without confronting the United States militarily. The federal advisories' repeated, almost monotonous recommendation — get these controllers off the public internet, put access behind a firewall or VPN, kill default passwords — is a tacit admission that the vulnerability isn't a single flaw but an entire category of exposed infrastructure that has been known and warned about since at least the 2023 Unitronics campaign, and still hasn't been fixed.