Iran Conflict Spills Over: Cyber Threats to Critical Infrastructure

Executive Summary

The ongoing conflict in the Middle East is driving a measurable increase in Iranian state-linked cyber operations targeting critical infrastructure sectors — energy, water, and transportation — beyond the immediate region. ESET's threat intelligence team, in a report published April 24, 2026, warns that defenders globally should prepare for a sustained campaign of disruptive and destructive attacks aimed at operational technology (OT) environments. The advisory does not cite specific CVEs or named malware families, but it provides a tactical framework for defenders to harden industrial control systems (ICS) against an elevated threat landscape.

Technical Analysis

ESET's analysis, based on observed activity since early 2026, indicates that Iranian-aligned threat actors are increasingly focusing on OT and industrial control systems (ICS) in sectors that are difficult to isolate — particularly energy grids, water treatment facilities, and transportation networks. The report emphasizes that these attacks are not limited to the Middle East; organizations in North America and Europe have also seen reconnaissance and probing activity targeting internet-exposed ICS devices, including programmable logic controllers (PLCs) and human-machine interfaces (HMIs).

ESET does not attribute the activity to a single named group (e.g., APT33, APT34, or affiliated hacktivist clusters), but notes that the operational tempo and targeting patterns are consistent with state-directed efforts. The advisory flags that attackers are leveraging publicly available tools and exploits rather than zero-days, making detection and network segmentation the primary defensive levers. Specific techniques include scanning for default credentials on industrial protocols (Modbus, DNP3) and exploiting known vulnerabilities in remote access solutions (e.g., VPNs, RDP gateways) to pivot into OT networks.

Mitigations & Recommendations

ESET recommends that organizations in critical infrastructure sectors immediately implement the following controls: enforce network segmentation between IT and OT environments using firewalls or unidirectional gateways; disable or change default credentials on all ICS devices; apply vendor patches for known vulnerabilities in remote access software; and deploy OT-specific monitoring tools that can detect anomalous protocol traffic (e.g., unexpected Modbus function codes). Defenders should also review incident response plans for scenarios involving physical process disruption, not just data theft. ESET notes that while no single mitigation is a silver bullet, layered defenses significantly raise the cost of a successful intrusion.