Tenable: AI and Iran-linked groups heighten risk to critical infrastructure
Tenable research warns that AI-driven attacks and nation-state threats are exploiting visibility gaps in critical infrastructure networks.
Key points
- Iran-affiliated APT groups have attacked U.S. water, energy, and government facilities since February.
- Attackers use AI to map converged IT/OT networks and exploit uninventoried legacy systems.
- CISA urges operators to replace unsupported legacy devices and prepare rapid recovery plans.
Tenable’s latest research indicates that critical infrastructure organizations face heightened cyber risks from nation-state groups and artificial intelligence-driven attacks. The security vendor published these findings as part of its Cybersecurity Awareness Month blog series, highlighting mounting threats to essential services.
According to Tenable, attackers are leveraging AI to map converged IT and operational technology networks at machine speed. These adversaries exploit uninventoried legacy systems and use AI to attain specialized knowledge for breaching complex industrial control systems. Asset visibility gaps create hidden attack vectors for these campaigns.
Threat Landscape and Actor Tactics
Iran-affiliated advanced persistent threat groups have attacked U.S. water, energy, and government facilities since the United States launched Operation Epic Fury in February, according to the U.S. government. Global cybersecurity agencies document that these nation-state groups have shifted focus from stealthy espionage to destructive attacks designed to disrupt victims’ operations.
Critical infrastructure organizations must secure complex environments where IT and operational technology converge. Tenable notes that many older OT systems are difficult to inventory, leaving them unmonitored and unpatched. This lack of visibility allows attackers to target unsupported legacy devices that remain connected to modern networks.
Agency Guidance and Industry Response
The Cybersecurity and Infrastructure Security Agency is urging critical infrastructure operators to establish a solid cyber hygiene foundation. CISA’s recommendations include reducing vulnerabilities, replacing unsupported legacy devices, and preparing rapid recovery plans. The agency labels this year’s campaign “Securing the Next 250” to signal the importance of cybersecurity for the country’s future.
CISA states that critical infrastructure and those who own, operate, supply, or support it are the front line against successful cyber intrusions. The agency emphasizes that ensuring vital services remain available to citizens is essential for keeping America’s global competitive edge. Organizations can seek support from agencies like CISA, the Center for Internet Security, and the SANS Institute.
What should you do?
Operators should audit their operational technology environments to identify and inventory all connected devices, particularly older systems that may be unmonitored. Security teams need to implement strict access controls and monitoring for converged IT/OT networks to detect anomalous activity at machine speed. Organizations must develop and test rapid recovery plans to mitigate the impact of destructive attacks on essential services.
What to do and how to stay safe: Tenable
- Inventory all operational technology assets to eliminate visibility gaps and identify unpatched legacy systems.
- Implement strict network segmentation between IT and OT environments to limit lateral movement.
- Train employees to recognize phishing attempts and report suspicious activity to security teams.
- Develop and regularly test rapid recovery plans to ensure business continuity during disruptions.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific sectors are being targeted by Iran-affiliated groups?
According to the U.S. government, Iran-affiliated APT groups have attacked U.S. water, energy, and government facilities since February.
How are attackers using artificial intelligence in these campaigns?
Attackers leverage AI to map converged IT/OT networks at machine speed and attain specialized know-how to breach complex industrial control systems.
What steps does CISA recommend for critical infrastructure operators?
CISA urges operators to reduce vulnerabilities, replace unsupported legacy devices, and prepare rapid recovery plans as part of solid cyber hygiene.
