Critical infrastructure orgs face heightened cyber risk from nation-state groups, AI threats

Critical infrastructure sectors are increasingly targeted by nation-state threat actors, notably Iran-affiliated APT groups, who have escalated from covert espionage to disruptive cyber attacks. These attacks exploit visibility gaps in complex IT/OT environments, particularly unmonitored legacy OT systems. Attackers use AI to accelerate network mapping and develop specialized knowledge to breach industrial control systems. The U.S. government’s Operation Epic Fury highlights ongoing attacks on U.S. critical infrastructure. In response, CISA’s Cybersecurity Awareness Month 2026 campaign focuses on foundational cybersecurity measures—reducing vulnerabilities, replacing unsupported devices, and ensuring rapid recovery capabilities. CISA recommends best practices including phishing awareness, strong multifactor authentication, prompt patching, system monitoring, data encryption, and incident response preparedness to defend against these evolving threats.

The threat landscape for critical infrastructure organizations has intensified with nation-state actors conducting destructive cyber attacks aimed at disrupting essential services such as water, energy, transportation, and healthcare. The use of AI by attackers to map and exploit converged IT/OT networks increases the speed and sophistication of attacks. Asset visibility gaps and unsupported legacy OT systems create hidden vulnerabilities that can be exploited. Disruptions to critical infrastructure can have significant societal and economic consequences. The shift from espionage to disruptive attacks increases the risk of operational outages and damage to critical services.

CISA advises critical infrastructure organizations to establish a strong cyber hygiene foundation by focusing on three pillars: reduce vulnerabilities, replace unsupported legacy devices, and recover quickly. Specific recommendations include educating employees to recognize phishing, enforcing strong passwords and phishing-resistant multifactor authentication, promptly applying software updates and patches, monitoring and logging system activity, backing up and encrypting data, and maintaining and practicing incident response plans. These measures are intended to mitigate risks from nation-state and AI-driven cyber attacks. No specific patch or fix applies as this is a threat landscape advisory rather than a software vulnerability.