Iran-Linked Hackers Expand US Infrastructure Targeting to Telecoms

Iranian government-linked intrusion attempts against American water, energy, and now telecommunications networks have escalated through late August and early September, federal agencies warn.

Intelligence Lead

Iranian government-linked hackers have widened their targeting of American critical infrastructure to include telecommunications networks for the first time, joining water and energy utilities as active target sectors. The expansion, reported by federal investigators and confirmed by multiple cybersecurity outlets in the first week of September, marks a deliberate broadening of Tehran's cyber posture as the U.S.-Israel-Iran war, now in its seventh month, continues to shape asymmetric retaliation options available to Iranian state and state-aligned actors.

Situation Report

Federal investigators report that Iranian-affiliated cyber actors have shifted focus toward internet-exposed operational technology tied to telecommunications providers, extending a campaign that CISA, the FBI, the NSA, and the Department of Energy have tracked since an April 2026 advisory first flagged intrusions against programmable logic controllers (PLCs) manufactured by Rockwell Automation and Allen-Bradley. A July update to that advisory confirmed the target set had grown to include PLCs from Schneider Electric and Siemens, and September reporting is the first to place telecommunications squarely alongside water and energy as an actively probed category.

Attackers have concentrated on internet-exposed automated control systems rather than corporate networks, a pattern consistent with earlier phases of the campaign in which more than 100 U.S. water and wastewater entities were targeted in a single month. NBC News reported on September 2 that recent attempts against telecommunications infrastructure have not produced confirmed disruption, though the shift in targeting itself is assessed as significant by federal officials tracking the campaign.

The escalation coincides with Iranian state-linked messaging channels warning that U.S. energy, water, and telecommunications infrastructure would be targeted in response to what Tehran characterizes as ignored warnings to halt strikes on Iranian territory. This messaging followed the February 28 launch of coordinated U.S.-Israeli airstrikes on Iranian leadership and nuclear infrastructure, an operation that has kept Strait of Hormuz shipping restricted and sustained elevated global energy and freight risk through the summer.

Separately, and assessed as unrelated in tasking but illustrative of the broader threat environment, Russian state-linked actor APT28 (tracked as BlueDelta, Fancy Bear, and Forest Blizzard) has deployed a lightweight Windows backdoor named HOOKEDGE against European government, diplomatic, and defense-manufacturing targets, with newer variants observed against Romania, Spain, and Turkey through June and July.

Background & Context

The current campaign traces to an April 2026 joint advisory in which CISA and the FBI first disclosed that Iran-linked actors were manipulating project files on internet-connected PLCs, altering displayed values to mask outages and disrupt operator awareness. That technique, low-cost and difficult to attribute in real time, has remained the campaign's operational signature even as the target list has grown.

The broader context is the U.S.-Israeli war on Iran, now the dominant driver of Middle East security calculus since strikes began in late February. Tehran's conventional retaliatory options remain constrained by degraded air defenses and continued coalition strikes, leaving cyber operations against U.S. domestic infrastructure as one of the few asymmetric levers available that does not risk direct military escalation on Iranian soil.

Telecommunications infrastructure carries distinct strategic value beyond water and energy: disruption there degrades emergency communications, financial transaction processing, and coordination among first responders and utility operators simultaneously, amplifying the effect of any parallel action against water or power systems.

Analysis & Assessment

The addition of telecommunications to the target set is assessed as a deliberate escalation rather than opportunistic drift. Iranian operators have consistently favored internet-exposed operational technology over harder corporate targets, suggesting the campaign remains reconnaissance- and disruption-oriented rather than aimed at sustained destructive effect, at least for now. Confidence in this assessment is moderate: reporting to date describes attempted and probing activity rather than confirmed telecommunications outages.

Should Tehran conclude that conventional military options remain foreclosed, further expansion into transportation or financial-sector operational technology is plausible over the coming weeks, following the same PLC-manipulation tradecraft. The parallel HOOKEDGE activity against European diplomatic and defense targets indicates that Moscow and Tehran are pursuing independent but temporally overlapping campaigns, each exploiting the West's divided attention across two active theaters.

U.S. utilities operating internet-exposed PLCs from the vendors named in the CISA advisories remain the highest-probability near-term targets. The absence of confirmed destructive outcomes to date should not be read as an indicator of Iranian restraint; it more likely reflects the current reconnaissance phase of the operation and the resilience of segmented control-system architectures at better-defended facilities.