Iran-linked hackers have successfully targeted and caused disruptions at multiple US oil and gas and water sites in recent weeks, according to a federal advisory released Tuesday and three sources familiar with the investigation.

The hacking campaign marked an escalation of the cyberattacks launched by Tehran since the US-Israeli war with Iran began because it tested the safety systems at US industrial plants that protect human life.

The hacks have caused some industrial processes at the sites to shut down, forcing them to operate manually, the sources said. That downtime has caused financial losses for some of the victims, the federal advisory said. The hackers have in some cases tried to use destructive malware, or “wipers,” to delete data from victim companies, but it was unclear if they were successful, two of the sources said.

The FBI, the Department of Homeland Security’s cyber agency and others said Tuesday they were “urgently warning” US critical infrastructure firms about the ongoing hacking campaign, which officials said was aimed at causing “disruptive effects within the United States.

Later on Tuesday, President Donald Trump said he’d agreed to a two-week ceasefire with Iran, less than two hours before his 8 p.m. deadline to destroy a “whole civilization.” He has also previously threatened to bomb power plants in Iran.

While Iranian missiles can’t yet hit the US homeland, the hacking campaign offers an opportunity for Iran to respond asymmetrically by hitting the US critical infrastructure in cyberspace.

“Government and experts have been warning about internet connected systems for years, and how vulnerable they are,” said one source familiar with the federal investigation into the hacks. “The companies who paid attention and have severe consequences already removed those systems and followed the guidance.”

The concern is for the critical US infrastructure providers that haven’t been paying as close attention.

The Iran-linked hackers are opportunistically targeting internet-facing programmable logic controllers, the devices that allow machinery to communicate at industrial plants around the world. That “opens up the opportunity not just for immediate disruption, but potentially modification of operating parameters that could impact physical operations,” said Joe Slowik, director of cybersecurity alerting strategy at Dataminr and an industrial cybersecurity expert.

“The latter could lead to physical impacts and safety concerns, which is a serious issue and represents a notable extension of adversary capability and intent” from previous activity affiliated with certain Iranian hackers, Slowik said.

While the US and Israel have steadily bombed Iranian government facilities for weeks, Iran has managed to use its cyber personnel to pull off cyberattacks ranging from the embarrassing to the concerning. Tehran-linked hackers last month leaked emails stolen from the private account of FBI Director Kash Patel. Before that, they disrupted business for a major US medical device maker.

The cyber activity often has a psychological component. Iranian hackers boasted online of the hacks against Patel and the medical device maker while exaggerating their impact.

“Iran maintains persistent intent to target the U.S. and its allies and partners with cyber operations despite the challenges it faced most recently on display during the 12-Day War in 2025, during which Tehran struggled to defend itself against Israeli cyberattacks and to respond in kind,” US intelligence agencies said in their annual worldwide threat assessment released in March. (CNN)

Update news