Critical

Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn

CyberScoop

April 7, 2026 at 5:58 PM

Actively Exploited

Overview

U.S. government agencies have issued an urgent warning about Iranian hackers targeting American energy and water infrastructure. These cyberattacks are aimed at disrupting devices and systems that manage industrial processes. Reports indicate that these attacks have already caused damage to some victims over the past month, coinciding with increased tensions due to U.S.-Israel strikes against Iran. This situation raises concerns about the security of critical infrastructure, as such attacks could lead to significant disruptions in essential services like electricity and water supply. Officials are urging organizations in the energy and water sectors to bolster their defenses against these threats.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Energy and water infrastructure systems, industrial control systems
Action Required: Organizations should enhance cybersecurity measures, monitor systems for unusual activity, and ensure software and systems are up to date.
Timeline: Ongoing since last month

Original Article Summary

Iranian government hackers are launching disruptive cyberattacks on American energy and water infrastructure, U.S. government agencies “urgently” warned Tuesday. The hackers are taking aim at devices and systems that control industrial processes, and have harmed victims in the last month following the onset of U.S.-Israel strikes against Iran, according to the joint alert from the […] The post Iranian hackers launching disruptive attacks at U.S. energy, water targets, feds warn appeared first on CyberScoop.

Impact

Energy and water infrastructure systems, industrial control systems

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since last month

Remediation

Organizations should enhance cybersecurity measures, monitor systems for unusual activity, and ensure software and systems are up to date.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Critical.

Read Original Article

Related Coverage

Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

BleepingComputer

A recent campaign has targeted D-Link and Ubiquiti devices across 34 countries, allowing hackers to hijack these devices to create a commercial residential proxy network. This practice, known as proxyjacking, enables attackers to monetize stolen bandwidth from unsuspecting users. The impact is significant as it not only affects individual users' internet speeds and data privacy but also raises concerns about the security of these widely used devices. Users whose devices have been compromised may find their internet connections slower and could potentially face additional security risks if their devices are manipulated for illicit purposes. The situation underscores the need for users to secure their devices and remain vigilant against unauthorized access.

Oct 15, 2026

Fake Arch Linux packages push malware with root privileges

BleepingComputer

Recently, malicious packages mimicking two widely-used Arch Linux tools, yay and paru, were discovered in the Arch User Repository (AUR). These fake packages were designed to install malware with root privileges, posing a significant risk to users who unknowingly downloaded them. The attackers exploited the trust users place in popular software by creating these deceptive packages. This incident emphasizes the importance of verifying package sources before installation, as users can be easily misled by seemingly legitimate software. Those affected are primarily Arch Linux users who rely on AUR for software installation, and they need to remain vigilant against similar threats in the future.

Oct 15, 2026

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads

The Hacker News

Researchers from Citizen Lab reported that the Israeli spyware company Candiru has successfully infected devices at Al Jazeera using zero-click attacks via online advertisements. This means that users did not need to interact with the ads for the malware to activate; it could run automatically when an ad loaded, even if it was hidden from view. This incident raises serious concerns about the security of digital advertising and how it can be exploited to target specific organizations. Al Jazeera, a prominent news network, is particularly significant as it plays a crucial role in global media coverage. The ability for spyware to infiltrate devices without any user action emphasizes the need for stronger security measures in ad systems and for organizations to be vigilant against such sophisticated attacks.

Oct 15, 2026

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

The Hacker News

The threat actor known as Silent Lynx has been linked to a series of attacks targeting government agencies in the Commonwealth of Independent States (CIS) from June 2025 to August 2026. These attacks utilize various methods to deploy malware, including macro-enabled documents, PS2EXE downloaders, PowerShell scripts hosted on GitHub, and specifically crafted WinRAR archives. The use of these techniques allows attackers to establish reverse shells on compromised systems, giving them remote access. This situation is particularly concerning for government organizations, as it compromises sensitive information and operational security. The ongoing threat demonstrates the need for heightened vigilance and security measures in these sectors.

Oct 15, 2026

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

The Hacker News

NGINX has released updates to address five vulnerabilities, including a significant flaw that has persisted since May 2005. Among these are three memory-related issues that could crash a worker process or potentially allow an attacker to execute arbitrary code, contingent on specific configurations. Additionally, one vulnerability could enable attackers to forge a TLS session, bypassing client certificate checks. These vulnerabilities affect all versions of NGINX since the identified flaw's introduction, making it crucial for users to update promptly. The release of versions 1.30.6 and 1.31.7 on October 14 is a direct response to these security risks, emphasizing the need for users to maintain up-to-date software to protect against exploitation.

Oct 15, 2026

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

The Hacker News

Next.js has rolled out an urgent security patch that addresses two serious vulnerabilities allowing unauthenticated remote code execution (RCE) and a high-severity denial-of-service (DoS) issue. The first RCE flaw is linked to React Server Components, while the second involves librsvg, an open-source library used by Next.js for processing SVG images through the sharp package. This update, released on October 14, is crucial for developers using Next.js, as it can prevent attackers from executing malicious code on affected systems. Users should apply this patch promptly to protect their applications from potential exploitation. The vulnerabilities could have serious implications for any web applications relying on Next.js, making swift remediation essential.

Oct 15, 2026