Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threats

Critical infrastructure faces mounting threats from nation-state groups and AI-driven attacks. In the latest installment of our Cybersecurity Awareness Month blog series, learn how leading cybersecurity agencies, such as CISA, are advising critical infrastructure organizations on ways to protect themselves and the essential services they provide.

Key takeaways

• Critical infrastructure organizations often struggle with asset visibility gaps that create hidden attack vectors. Many older OT systems are difficult to inventory, leaving them unmonitored and unpatched.
• Attackers are leveraging AI to map converged IT/OT networks at machine speed and exploit uninventoried legacy systems. Attackers are also using AI to attain the specialized know-how to breach complex industrial control systems.
• Iran-affiliated APT groups have attacked U.S. water, energy, and government facilities since the U.S. launched Operation Epic Fury in February, according to the U.S. government.
• As part of Cybersecurity Awareness Month, CISA is urging critical infrastructure operators to establish a solid cyber hygiene foundation, anchored on reducing vulnerabilities, replacing unsupported legacy devices, and preparing rapid recovery plans.

Cybersecurity Awareness Month 2026 finds critical infrastructure organizations facing a particularly daunting cyber risk landscape.

Always a prime target for cybercriminals, hacktivists, and nation-state hacking groups, critical infrastructure organizations this year have been grappling with a heightened threat from adversaries affiliated with Iran’s government, as documented by global cybersecurity agencies and researchers. Specifically, many of these nation-state groups have shifted their focus from stealthy cyber espionage activities to destructive cyber attacks designed to disrupt victims’ operations, experts have observed.

In addition, critical infrastructure organizations, which often must secure complex environments where IT and operational technology (OT) converge, now also have to contend with AI-boosted cyber attacks.

Now in its 22nd year, Cybersecurity Awareness Month serves as a good reminder that critical infrastructure organizations can seek support and guidance from leading cybersecurity agencies, as well as from globally recognized cybersecurity organizations such as the Center for Internet Security (CIS) and the SANS Institute.

For example, this year, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) is focusing its Cybersecurity Awareness Month message on protecting U.S. critical infrastructure against cyber threats, riffing on the 250th anniversary of the country’s founding. By labeling this year’s campaign “Securing the Next 250,” CISA is signaling the importance of cybersecurity for the country’s future.

“From keeping America’s global competitive edge to ensuring vital services remain available to our citizens, U.S. critical infrastructure and those who own, operate, supply, or support it are the front line against successful cyber intrusions,” reads a CISA statement.

In this blog, we’ll outline key CISA advice aimed at helping critical infrastructure organizations mitigate the risk from cyber attackers, in particular nation-state hacking groups intent on disrupting essential services, such as water, electricity, transportation and healthcare.

7 important cybersecurity tips for critical infrastructure orgs across industries

Adversaries generally look for the easiest way to breach a targeted organization before resorting to more complex attacks. That’s why ensuring your organization has a solid cyber hygiene foundation is essential.

Along those lines, CISA this year is stressing recommendations and best practices that all critical infrastructure organizations can adopt to boost their core cybersecurity posture, regardless of their industry sector.

• Educate your employees on how to recognize phishing attempts. Make it easy for them to report this and other suspicious activity to your security team.
• Harden user account security by requiring the use of strong passwords and by adopting phishing-resistant multifactor authentication.
• Update software promptly, fix misconfigurations, and patch the vulnerabilities that pose the highest risk to your organization.
• Monitor and log your systems’ activity to spot attack attempts.
• Back up and encrypt your data.
• Draft an incident response plan, update it regularly, and conduct periodic practice drills.
• Be ready to recover from system disruptions stemming from a breach, including by implementing workarounds that allow your organization to conduct essential functions while critical assets and resources are unavailable.

To make these foundational cybersecurity best practices easier for critical infrastructure operators to remember, CISA is emphasizing what it calls the three R’s:

• Reduce vulnerabilities.
• Replace devices that vendors no longer support.
• Recover quickly to maintain operations.

To get more details about these three cybersecurity pillars for critical infrastructure organizations, CISA recommends security teams check out its:

• Binding Operational Directive “Prioritizing Security Updates Based on Risk” (BOD 26-04), published in June
• BOD 26-02 “Mitigating Risk From End-of-Support Edge Devices,” published in February
• CI Fortify initiative

Meanwhile, CISA and the cybersecurity agencies of Australia, Canada, Germany, the Netherlands, New Zealand, and the U.K. published earlier this year joint guidance for protecting OT systems, especially in critical infrastructure.

“Exposed and insecure OT connectivity is known to be targeted by both opportunistic and highly capable actors. This activity includes state-sponsored actors actively targeting critical national infrastructure (CNI) networks,” reads the joint guide, titled “Secure connectivity principles for operational technology.”

“Strengthening the cyber security of CNI, including securing OT connections, can challenge attackers’ efforts and raise the threshold necessary to cause physical harm, environmental impact, and disruption,” the document adds.

That joint guide outlines eight core principles for securing OT environments:

• Balance the risks and opportunities.
• Limit the exposure of your connectivity.
• Centralize and standardize network connections.
• Use standardized and secure protocols.
• Harden your OT boundary.
• Limit the impact of compromise.
• Ensure all connectivity is logged and monitored.
• Establish an isolation plan.

How state-sponsored actors, hacktivists, and cybercriminals target critical infrastructure

A group of advanced persistent threat (APT) groups affiliated with Iran’s government has been carrying out ongoing attacks against U.S. water, energy, and government facilities since the U.S. launched Operation Epic Fury against the Middle East country in February, various U.S. government agencies warned in a joint advisory published in April and updated in July.

By targeting internet-connected OT devices, such as programmable logic controllers (PLCs), these APT groups have successfully disrupted the operations of multiple U.S. critical infrastructure organizations, causing them financial losses, according to the joint advisory.

“As a result of this activity, through malicious interactions with PLC project files and the manipulation of data displayed on human-machine interface (HMI) and supervisory control and data acquisition (SCADA) displays. In a few cases, this activity caused operational disruption and financial loss,” reads the advisory.

The tactics, techniques, and procedures (TTPs) are consistent with those employed by the CyberAv3ngers, a nation-state group the U.S. government previously identified as operating under Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC).

The joint advisory urges security teams at U.S. critical infrastructure organizations to review the document’s TTPs and indicators of compromise (IOCs), and implement recommended mitigation measures, such as:

• Install PLCs following manufacturers' guidelines and security best practices.
• Use secure gateways and firewalls to remove PLCs from direct internet exposure.
• Review your system logs to look for IOCs and for suspicious traffic on ports used by OT devices.

Tenable Research provides a deep dive on the CyberAv3ngers group in the blog “What to kow about CyberAv3ngers: The IRGC-linked group targeting critical infrastructure.”

Tenable Research has also documented how cyber adversaries linked to Iran’s Ministry of Intelligence and Security (MOIS) have intensified their attacks against the U.S. and other countries this year.

In the blog “Cyber retaliation: Analyzing Iranian cyber activity following Operation Epic Fury,” Tenable Research explains how Iranian-linked actors shifted their focus from stealthy espionage to coordinated, destructive campaigns targeting organizations in a variety of sectors, including critical infrastructure.

You can find more details about the threat from Iran-affiliated attackers in this Information Technology-Information Sharing and Analysis Center (IT-SAC) joint advisory.

The AI threat against critical infrastructure organizations

Like all cyber defenders, the security teams in charge of protecting critical infrastructure organizations are grappling with adversaries’ use of AI to make their attacks stealthier, faster, smarter, and unpredictable.

However, critical infrastructure organizations’ security teams face unprecedented challenges when trying to prevent or respond to an AI-boosted attack, especially if their environment has both IT and OT systems.

These are some of the complicating factors for critical infrastructure security teams when addressing AI-aided attacks:

• After gaining initial entry via the IT environment, attackers using AI-driven automation can map the converged network, pivot and discover pathways into the organization’s OT infrastructure, all at machine speed.
• IT and security teams struggle to comprehensively inventory OT environments. For starters, many legacy OT systems lack standard discovery protocols like Simple Network Management Protocol (SNMP), meaning they can’t “announce” themselves to modern asset-inventory tools like IT systems do. Legacy OT systems also often don’t respond well to active scanning, which can cause them to crash, potentially disrupting a community’s essential services. In addition, OT assets are rarely housed in data centers, but rather can be scattered across myriad physical locations, such as within electrical substations, throughout a city’s water system, or in offshore oil rigs.These asset visibility gaps create a massive risk, because uninventoried OT systems may not be getting monitored or patched regularly, making them low-hanging fruit for attackers who use AI to map OT environments and find vulnerable OT assets in a flash.

IT and security teams struggle to comprehensively inventory OT environments. For starters, many legacy OT systems lack standard discovery protocols like Simple Network Management Protocol (SNMP), meaning they can’t “announce” themselves to modern asset-inventory tools like IT systems do.

Legacy OT systems also often don’t respond well to active scanning, which can cause them to crash, potentially disrupting a community’s essential services. In addition, OT assets are rarely housed in data centers, but rather can be scattered across myriad physical locations, such as within electrical substations, throughout a city’s water system, or in offshore oil rigs.

These asset visibility gaps create a massive risk, because uninventoried OT systems may not be getting monitored or patched regularly, making them low-hanging fruit for attackers who use AI to map OT environments and find vulnerable OT assets in a flash.

• Traditionally, compromising an industrial control system (ICS) required specialized engineering knowledge of these assets. But today, attackers can enlist an LLM to quickly provide detailed information about the design of a particular ICS, how it works, how it communicates with other systems, and plan how to breach it accordingly.

The White House’s Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security,” drives home the importance of protecting critical infrastructure organizations against AI-driven attacks.

Specifically, the EO calls for the federal government to facilitate access to cybersecurity tools and services, including covered frontier AI models, for critical infrastructure operators, so these organizations can strengthen their cybersecurity. The Tenable blog, “The June 2026 AI Executive Order: What federal agencies need to know and how Tenable can help,” unpacks the EO in detail.

For granular guidance on the intersection of AI and OT, we recommend you watch Tenable’s two-part webinar series “Frontier AI for OT,” which addresses topics including:

• Strategies to protect OT assets that you can’t patch, such as preemptively using tools that discover OT weaknesses at machine speed, and implementing strict OT network choke points and access controls
• Ways to prevent how attackers exploit the communications between your OT devices, including using machine learning systems to identify and analyze attack paths, and leveraging agentic AI to run continuous attack simulations
• Adopting an AI-driven exposure management platform like Tenable One, which helps you: Unify security data across all your OT and IT assetsIdentify and prioritize the most critical threatsAutomate workflows using agentic AIConduct guided remediation
• Unify security data across all your OT and IT assets
• Identify and prioritize the most critical threats
• Automate workflows using agentic AI
• Conduct guided remediation

Check back here next week, when we’ll continue our Cybersecurity Awareness Month series with a blog about how to mitigate the cyber risk from shadow AI. And if you missed it, read the first blog in this series: "How to mitigate the risk from AI-generated apps built by your 'citizen coder' employees."