US Security Agencies Issue Urgent Warning on Coordinated Iranian Cyberattacks Targeting Critical Infrastructure

According to the International Desk of Webangah News Agency, the United States has stated that Iran has taken the initiative in the realm of cyber warfare. In an unprecedented move reflecting strategic consensus at the highest levels of Washington’s security apparatus, five key U.S. government entities—including the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the Department of Energy, and the Environmental Protection Agency (EPA)—have pooled their resources to counter a massive and continuous series of cyberattacks by groups affiliated with the Islamic Republic of Iran. This joint, urgent alert signifies a coordinated effort to protect the nation’s critical lifelines.

This institutional coalition, formed for the first time with this composition and urgency, has declared its objective as the “integrated protection of U.S. vital arteries,” warning that energy, water, and government services infrastructure are at the forefront of this threat. According to the U.S. Cybersecurity and Infrastructure Security Agency, the published warning asserts that Iranian hackers have successfully penetrated and disrupted the deepest layers of American industrial systems, specifically programmable logic controllers (PLCs).

The report claims these attacks, which have significantly intensified since March 2026, have targeted several critical sectors, including energy networks (oil, gas, etc.), water and wastewater facilities, and government services. The released documents allege that the attacking group, identified as “Dead Networks” and linked to the Islamic Revolutionary Guard Corps (IRGC), has gained access to internet-connected PLC devices by employing multiple layers of obfuscation and utilizing a wide array of IP addresses and dispersed servers. Experts believe this flexible and distributed structure has made tracing and identifying the origin of the attacks extremely difficult for U.S. defense systems.

Significantly, according to this U.S. report, the scope of intrusion extends beyond a specific brand. U.S. security organizations have confirmed that devices from Rockwell Automation, Schneider Electric, Siemens, and even lesser-known PLC brands have been targeted. This development is reportedly the result of years of investment, elite training, and the development of indigenous technologies in Iran.

Technical experts at CISA claim that the attackers have not merely disabled devices but have manipulated the internal logic of programs. For instance, in one affected facility, hackers reportedly added code to a program that deactivates safety commands and emergency shutdown procedures without operators noticing the changes. This could lead a facility to enter an unsafe and critical condition without any warning, potentially resulting in catastrophic consequences such as material leaks, fires, or explosions, and causing incidents of unknown origin.

The report further claims that this operation is no longer a mere “intelligence intrusion”; the attackers have directly influenced physical and industrial processes, which could lead to irreparable consequences such as widespread water and power outages, or even explosions at petrochemical and power plants. These attacks have intensified amidst severely strained relations between Iran and the United States over regional and nuclear issues. According to the report, analysts believe these operations send a clear message to Washington: “Iran can disable your infrastructure before any military conflict.”

CISA reports also claim that this operation is not limited to the United States and that a similar pattern could be repeated for the critical infrastructure of other Western countries, including European nations and the Zionist regime. The disclosure of this warning by U.S. security entities is effectively an implicit admission of the severe vulnerability of Western industrial networks to Iranian cyberattacks.

According to this report, many international observers believe that the Islamic Republic of Iran has become one of the world’s leading cyber powers in recent years. The “Dead Networks” operation is considered a landmark in the history of cyber warfare, marking the first time a state-sponsored hacking group has been able to simultaneously and effectively target and disrupt industrial devices from multiple reputable global brands across a wide geographic area.

With rising regional tensions and escalating U.S. sanctions against Iran, these attacks are expected not only to continue but to adopt more sophisticated tactics and broader objectives.