- What: NBC News reports Iranian attempts against US water, telecommunications and energy infrastructure, sourced to four people with access to government and industry threat information.
- Outcome: the attempts have so far been unsuccessful, and an Iranian group has publicly warned of "unexpected and critical events" to come.
- What is missing: no CVEs, no device types, no techniques, no named agency. Anyone selling you a detection for this today is selling you something.
- Why it still matters: the last Iranian-linked ICS campaign that reached US water succeeded on default credentials. Failure this time says more about which targets were picked than about how much harder we got.
Most threat reporting arrives after the fact. This one arrived before, which is unusual enough to be worth acting on, and thin enough that acting on it means something other than writing a detection rule.
What the reporting actually supports
Four people with access to government and industry cyberthreat information described attempted Iranian attacks across water systems, telecommunications and energy. The attempts were unsuccessful. A group linked to Iran said publicly that "unexpected and critical events" would soon target American infrastructure.
That is the whole factual load. There are no CVEs, no vendor or device names, no described access method, no named official and no agency advisory behind it. We are writing about it anyway because the shape is actionable even when the detail is not, but the distinction matters: this is a warning, not an indicator set, and treating it as an indicator set produces a week of work that detects nothing.
"Unsuccessful" is being read as reassurance. It is better read as a sample. The previous Iranian-linked campaign to reach US water, the CyberAv3ngers activity against Unitronics PLCs in late 2023, did not fail, and it did not need a zero day: it needed devices exposed to the internet with the default password still set. CISA wrote it up in AA23-335A.
Nothing in this reporting suggests that class of target stopped existing. It suggests the attempts we heard about landed on organisations where it did not work. Those are different claims, and only one of them is comforting.
Telecom is the new word
Water and energy are the usual pairing in this kind of reporting, and we covered the water side in detail when CISA warned about it: see CISA Warns of Cyberattacks Disrupting US Water Utilities for the Unitronics path and the HMI manipulation pattern.
Telecommunications is the addition worth noticing, because it is not a target in the same way. Water and energy get hit for effect: change a setpoint, disrupt a process, produce a visible consequence. Telecom gets hit for access and for position, and the consequence is that someone is inside the path your other alerts travel over. An intrusion there is not loud and does not announce itself with a process going out of range.
What is actually worth doing this week
Because there are no indicators, the list is a posture list, and it is short:
- Find what is exposed, before someone else enumerates it. The 2023 campaign was an internet exposure problem wearing an ICS costume. Anything speaking a control protocol that answers from outside your perimeter is the finding, whatever the vendor.
- Default and shared credentials on control devices. Still the most reliable path into a plant floor, and still the one nobody wants to inventory because the answer is embarrassing.
- Know which of your telemetry sources would notice. If a setpoint changed at 3am, which feed carries it, and is that feed currently arriving? A source that stopped reporting looks identical to a quiet night, and this is the week to know which you have.
- Check your out-of-band path. If telecom is a target, the assumption that your alerting reaches a human over the same infrastructure deserves one deliberate test.
The part we would push back on
A public warning from a threat group is also an information operation. Announcing that critical events are coming costs nothing, and it produces exactly what we are doing right now: attention, coverage, and defenders spending a week reacting. That does not make the underlying attempts fake, four sources described real ones. It does mean the announcement and the activity should be weighed separately, and that a group telling you what it will do is not a group you should let set your priorities for the quarter.
Do the exposure and credential work. That work was already worth doing on Monday, which is the tell that it is the right answer.
Questions about your exposure?
We run OT and ICS assessments that start with what is reachable and what is authenticated, rather than with a threat name: OT / ICS assessment.