#critical-infrastructure

10 articles

The US has sanctioned the same Iranian hacking institute twice in eight years — and it still does not tell you who stopped a British power plant

2026-08-29World

Treasury designated nearly 60 Iran-linked entities, individuals and vessels under Operation Economic Outcast, including six people tied to the Mabna Institute — the outfit sanctioned in 2018 for stealing 31 terabytes from 320 universities. The designations concern US infrastructure. They do not name the UK attack, and the attribution there remains unconfirmed.

CISA red-teamed two organisations the same way — one saw nothing, the other cut them off in two minutes

2026-08-27Security

Advisory AA26-237A describes simultaneous red team assessments using similar tradecraft against a government services body and a water utility. Both were compromised at the domain level. One detected each phishing payload as it executed and isolated the machines within 2 to 20 minutes. The other saw nothing, and the red team read its security team's email to check.

A UK power plant was down for four days — and almost nothing in the headline is confirmed

2026-08-25Security

The Telegraph reported on 22 August that a small British generator was shut down for four days in July, and the coverage that followed called it Iran-linked. Neither the government nor the NCSC has confirmed that, the plant has not been named, and the CEO of Dragos is publicly warning that this is exactly the situation false flags are built for.

Five US agencies say the tooling aimed at Siemens PLCs was written with AI — and it is disguised as monitoring software

2026-08-20Security

The NSA, CISA, FBI, Department of Energy and EPA issued a joint advisory on Siemens S7 controllers. The exploitation scripts are Python built on snap7, they masquerade as legitimate OT monitoring tools, and they give read and write access to PLC memory and ladder logic. The assessed purpose is not disruption yet — it is being ready for it.

Medusa has gone from 300 critical infrastructure victims to more than 500 — and it pays up to $1 million for a way in

2026-08-19Security

A joint CISA, FBI and HHS advisory puts Medusa past 500 US critical infrastructure organisations as of April 2026, up from 300-plus in March 2025. The number that explains the growth is not the victim count: it is the $100 to $1 million the operation pays initial access brokers.

The backdoor persists by rewriting your browser shortcut — and it is aimed at India's government IT networks

2026-08-18World

Acronis attributes PATCHCORD to APT36 with moderate confidence. It arrives as a fake Afghan Telecom transport app, hides its console window, and survives reboots by hijacking the Chrome, Edge and Firefox shortcuts on the desktop.

91% of US water systems serve under 10,000 people — a Senate bill and a DEF CON project are both aiming there

2026-08-14World

The Water Cyber Shield Act would give the EPA explicit cyber authority and $300m a year. Separately, DEF CON Franklin and the rural water association launched a monitoring centre funded by Craig Newmark.

CISA, the FBI and South Korea issued a joint warning on Gunra — and its Linux locker has a flaw that lets you decrypt for free

2026-08-12Security

51 victims since April 2025, mostly outside North America, exploiting a 2024 Schneider Electric flaw and a 2025 Fortinet one. The advisory is worth reading for what it says about which patches actually matter.

Attackers walked from a wind farm to a heat plant's turbine over a private cellular network

2026-08-12Security

CERT Polska's report on a December 2025 intrusion at a Polish CHP plant describes what it calls the first real-world use of a private APN as an attack path. The controller they landed on still had its default admin password.

Thirty water systems were disrupted without exploiting a single vulnerability

2026-08-10Security

Attackers changed passwords and IP addresses on controllers that were already reachable from the internet, locking operators out and triggering boil-water notices. Forescout then found 4,407 exposed Rockwell PLCs worldwide — most of them on mobile carrier networks.