U.S. CRITICAL INFRASTRUCTURE UNDER CYBER ASSAULT: FEDERAL RECORDS EXPOSE IRANIAN, CHINESE, RUSSIAN, AND NORTH KOREAN OPERATIONS

TRJ CYBERSECURITY REPORT | NOVEMBER 13, 2026

Federal investigations reveal escalating foreign cyber operations targeting American critical infrastructure, government networks, industrial control systems, and essential services, exposing the growing threat posed by state-sponsored actors and sophisticated criminal networks

The United States is confronting a sustained series of foreign cyber operations targeting critical infrastructure, federal agencies, telecommunications equipment, industrial control systems, financial networks, and the technologies supporting essential public services. Federal investigations and cybersecurity advisories issued throughout 2026 reveal an extensive threat environment involving Iranian-affiliated operators, Chinese state-sponsored hacking organizations, Russian military intelligence, and North Korean cyber units. These campaigns involve different objectives and technical methods, but collectively demonstrate the ability of foreign adversaries to penetrate sensitive networks, manipulate connected equipment, steal valuable information, and establish unauthorized access to systems supporting American institutions.

The seriousness of these operations extends beyond conventional cyber espionage. Federal authorities have confirmed incidents involving operational disruption at industrial facilities, malicious manipulation of internet-connected equipment, exploitation of compromised routers, and the deployment of sophisticated infrastructure designed to conceal unauthorized network activity. Some campaigns seek intelligence or financial resources, while others demonstrate capabilities that could be used to interfere with physical operations. The growing dependence of American infrastructure on interconnected technologies creates opportunities for hostile actors to exploit vulnerabilities across systems that were once more isolated from public networks.

---

IRAN: CYBER OPERATIONS REACH INDUSTRIAL INFRASTRUCTURE

Iranian-affiliated cyber operations present a direct threat to American operational technology. On April 7, 2026, the Federal Bureau of Investigation, Cybersecurity and Infrastructure Security Agency, National Security Agency, Environmental Protection Agency, Department of Energy, and U.S. Cyber Command issued a joint advisory warning that Iranian-affiliated advanced persistent threat actors were actively exploiting internet-connected programmable logic controllers across multiple critical infrastructure sectors. These devices regulate industrial machinery and processes, making unauthorized changes potentially consequential for physical equipment and the services it supports. Federal authorities reported that the activity had produced operational disruptions and financial losses, establishing that the campaign had progressed beyond network reconnaissance.

The original warning specifically identified Rockwell Automation and Allen-Bradley programmable logic controllers, including equipment accessible through poorly protected network connections. On July 22, federal authorities expanded their guidance to address observed targeting involving Schneider Electric and Siemens equipment, as well as malicious modifications to reusable code modules within industrial control programs. These developments broadened the known technical scope of the campaign. An attacker capable of altering controller programming may be able to change how equipment operates without first compromising every component of the larger industrial network. The consequences depend upon the installation, controller privileges, existing protections, and physical processes involved.

Separate incidents disclosed on July 30 reinforced the danger facing American water infrastructure. The FBI and EPA reported that water and wastewater utilities in at least seven states had notified federal authorities of cyber incidents involving internet-facing operational technology since July 27. The activity targeted Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 controllers, and some incidents degraded water operations. These events establish documented interference with essential infrastructure. The agencies did not definitively assign that particular group of incidents to the Iranian government, making it necessary to distinguish those cases from the separately attributed Iranian-affiliated campaign.

Iranian cyber activity has also targeted intellectual property, government information, and individuals considered adversaries of Tehran. On August 18, the Justice Department unsealed a superseding indictment charging 17 individuals associated with the Iran-based Mabna Institute. Prosecutors alleged that the organization conducted intrusions involving 144 American universities, 178 foreign universities, at least 42 American private-sector companies, and multiple government agencies. The indictment describes the theft of academic information, proprietary research, and compromised email accounts, including operations allegedly conducted for the Islamic Revolutionary Guard Corps. The charges remain allegations, and the defendants are presumed innocent unless proven guilty. In September, the FBI separately updated its warning concerning HEAVYGRAM malware, which Iranian intelligence-linked actors have used to target dissidents, journalists, and opposition figures through malicious software controlled using Telegram-based communications.

---

CHINA: COMPROMISED DEVICES BECOME HIDDEN ATTACK INFRASTRUCTURE

Chinese state-sponsored cyber operations reveal another dimension of the threat: the creation of distributed networks that conceal the location and identity of malicious activity. On August 26, 2026, the Justice Department and FBI announced the court-authorized seizure of domains associated with QScan and QTRouter, two platforms operated by the China-linked QTFY organization. Federal court documents identified the group as operating through Nanjing Xinjiuwei Network Technology Company and providing computer hacking services to customers that included China’s Ministry of State Security and People’s Liberation Army. The platforms were designed to work together, using automated scanning, infected internet-connected devices, commercial proxy infrastructure, and leased servers to support computer intrusions.

QScan was used to identify and compromise devices connected to the internet, while QTRouter assembled compromised systems into an obfuscation network capable of routing malicious communications through locations outside China. This architecture allowed hostile activity to appear as though it originated from unrelated computers, including devices geographically close to intended targets. Federal authorities identified the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department of Health and Human Services, National Institutes of Health, and U.S. Senate among organizations targeted by QTFY. The domain seizures disrupted the platforms’ essential communications and authentication functions, rendering the identified systems inoperable.

The QTFY investigation fits within a broader history of Chinese state-sponsored exploitation of American infrastructure. Federal agencies previously disrupted the Volt Typhoon network, which used compromised routers to conceal intrusions into critical infrastructure, and the Flax Typhoon botnet, which incorporated large numbers of infected internet-connected devices. These campaigns demonstrate how ordinary networking equipment can become part of hostile cyber infrastructure without its owners recognizing the compromise. Unauthorized access to edge devices is particularly significant because routers, firewalls, and remote-access gateways sit at the boundaries of institutional networks and often provide pathways into more sensitive systems.

---

RUSSIA: MILITARY INTELLIGENCE TARGETS THE NETWORKING LAYER

Russian military intelligence has pursued operations targeting the fundamental networking systems that connect users and organizations to digital services. On April 7, 2026, the Justice Department and FBI announced a court-authorized operation against compromised small-office and home-office routers controlled by Unit 26165 of Russia’s Main Intelligence Directorate, commonly identified as the GRU. The military intelligence unit is associated with APT28, also known as Fancy Bear, Forest Blizzard, and several other designations. According to federal authorities, the compromised routers supported malicious Domain Name System hijacking operations targeting individuals and organizations of intelligence interest to the Russian government.

The GRU operation involved exploitation of known router vulnerabilities and theft of device credentials dating back to at least 2024. DNS hijacking is particularly dangerous because the Domain Name System translates internet addresses into the network destinations computers use to establish connections. Manipulating that process can redirect communications toward attacker-controlled infrastructure, enabling surveillance, credential theft, or access to information intended for legitimate services. The federal disruption neutralized the American portion of the identified network, but the investigation illustrates how compromised consumer and small-business equipment can support military intelligence operations against government, defense, and critical infrastructure personnel.

Russian state-supported actors have also conducted credential theft and phishing campaigns against organizations using commercial communications platforms. Federal advisories describe targeting involving messaging applications and the Zimbra Collaboration Suite, reflecting a focus on gaining access to accounts containing sensitive organizational information. These activities differ technically from the GRU router operation, but they demonstrate the continuing importance of compromised identities and trusted communications channels in intelligence collection. Organizations that secure perimeter infrastructure while neglecting user authentication and account monitoring remain exposed to intrusion through legitimate-looking access.

---

NORTH KOREA: FINANCIAL THEFT EXPANDS INTO SOFTWARE SUPPLY CHAINS

North Korea’s cyber operations have developed into a substantial source of illicit revenue while also creating opportunities for broader technology compromise. On November 12, 2026, the Department of Justice announced coordinated enforcement actions against the Democratic People’s Republic of Korea’s cryptocurrency theft operations, including the disruption of cloud infrastructure used in a social-engineering campaign identified by the FBI as FaceStealer. Federal authorities attributed more than $400 million in cryptocurrency theft over approximately 18 months to the campaign and warned that its operators were targeting individuals responsible for maintaining open-source software projects.

FaceStealer uses compromised communications accounts, deceptive video meetings, prerecorded victim footage, and artificial intelligence-generated impersonations to establish trust with intended targets. During these encounters, attackers introduce a fabricated technical problem and direct the victim toward a supposed repair procedure that installs malicious software. Once a computer is compromised, operators can access cryptocurrency assets, communications accounts, and additional network resources. The FBI reported seizing more than 900 webcam recordings obtained through the scheme. Targeting software maintainers creates an additional risk because a compromised developer account may provide an attacker with access to source-code repositories or software distribution mechanisms used by numerous organizations.

The November 12 enforcement announcement also disclosed significant progress in freezing stolen assets associated with North Korea’s October 29 attack against Binance, which the FBI attributed to the TraderTraitor operation. Federal authorities reported that coordinated government and private-sector action had frozen more than $2.7 billion in stolen cryptocurrency, with court authorization obtained to seize or restrain more than $1.2 billion of those assets. The original theft exceeded $6 billion. Unlike the operational technology intrusions associated with Iran, North Korea’s financial campaigns principally target digital assets and the systems protecting them. Their consequences extend into national security because federal authorities identify cryptocurrency theft as a source of funding for the North Korean government’s activities, including its weapons programs.

---

ADDITIONAL THREATS: CRIMINAL NETWORKS AND INDUSTRIAL SYSTEMS

Foreign state-sponsored operators are not the only organizations capable of threatening American infrastructure. On November 12, the Justice Department announced an international law enforcement operation that removed Gootloader malware from more than 100 compromised servers, including WordPress installations, and seized domains used to distribute and control the malware. Federal authorities reported that Gootloader had infected at least 25,000 computers worldwide since 2018 and had been associated with ransomware attacks affecting at least 44 American victims, producing approximately $28.8 million in losses. The malware was used to establish access to compromised computers, which could then be sold to other criminals for additional exploitation. The operation also affected threats directed toward American defense-related organizations. The Justice Department did not attribute the Gootloader infrastructure to one of the foreign governments identified in the state-sponsored investigations.

Another federal warning issued November 5 addressed malicious targeting of industrial refrigeration and cold-chain monitoring systems. These technologies support temperature-sensitive operations across healthcare, agriculture, chemical processing, transportation, and food distribution. Unauthorized manipulation of industrial refrigeration controls could interfere with equipment operation, damage stored products, or create hazardous conditions. The advisory demonstrates that the range of industrial systems exposed to malicious activity extends beyond electrical grids, water utilities, and telecommunications. Equipment previously treated primarily as a facility-management responsibility now requires cybersecurity protections appropriate to its operational importance.

---

THE STRATEGIC EXPOSURE OF AMERICAN INFRASTRUCTURE

The common vulnerability across these investigations is the intersection of operational systems, internet connectivity, identity management, and third-party technology. A compromised router may provide concealed access to a network. Stolen credentials may permit unauthorized activity through legitimate accounts. Malicious controller modifications can affect physical equipment, while compromised software development environments can expose organizations that trust affected code. These are distinct attack paths, each requiring different defensive controls. Their coexistence creates a complex security environment in which protecting a single system or blocking one malicious address cannot guarantee the integrity of an organization’s broader infrastructure.

The threat also extends beyond the institutions directly targeted. Hospitals depend upon communications providers, water treatment facilities rely on industrial equipment manufacturers, transportation systems use interconnected networks, and government agencies depend upon commercial software platforms. A serious compromise involving a shared provider could affect multiple customers or operations without requiring separate attacks against every downstream organization. The scope of such consequences depends upon how the affected technology is deployed, the availability of backup systems, and whether operators can maintain essential functions when digital services become unavailable.

Federal defensive guidance emphasizes restricting direct internet access to industrial controllers, removing unnecessary remote-management interfaces, replacing unsupported networking equipment, applying security updates, strengthening multifactor authentication, monitoring unusual account activity, and maintaining tested recovery procedures. Critical infrastructure organizations also require reliable inventories of connected operational equipment, separation between administrative and industrial networks, and procedures for identifying unauthorized configuration changes. These measures address the weaknesses documented across multiple federal investigations rather than relying upon assumptions about which foreign actor may attempt the next intrusion.

Current public records establish that foreign cyber operations against American infrastructure are active, technically sophisticated, and capable of producing serious consequences. They do not establish that the separate campaigns described in this report are operating under a unified command or that recent telecommunications and internet service disruptions resulted from coordinated hostile action. Determining whether an individual outage involved sabotage, malicious intrusion, equipment failure, or another technical cause requires incident-specific forensic evidence. The already documented cases provide sufficient grounds for concern without assigning responsibility where federal authorities have not established it.

---

TRJ VERDICT

The United States is facing a persistent cybersecurity threat that has moved beyond the traditional boundaries of espionage and financial crime. Federal investigations have exposed foreign operations capable of exploiting industrial equipment, compromising network infrastructure, concealing malicious traffic, and accessing systems supporting essential services. The danger lies not only in the sophistication of individual campaigns, but also in the dependence of modern American institutions upon interconnected technologies that can become avenues for unauthorized control.

Iranian-affiliated operations demonstrate the potential for cyber intrusions to interfere directly with physical processes. China’s documented use of distributed hacking infrastructure reveals the scale at which compromised devices can support intelligence and intrusion campaigns. Russian military intelligence has exploited weaknesses in network routing equipment to redirect communications and obtain sensitive information. North Korea has transformed social engineering and digital asset theft into a significant financial operation while targeting software development accounts that could provide access to a much broader technology ecosystem. Each presents a different national security challenge requiring specialized detection, investigation, and defensive capabilities.

America’s critical infrastructure cannot be protected through reactive security alone. Systems responsible for water treatment, communications, transportation, industrial production, and essential public services must be designed and maintained with the expectation that capable adversaries will attempt to compromise them. That requires organizations to identify exposed equipment, eliminate unnecessary access, verify system integrity, and preserve the ability to operate safely when connected technologies fail. Government warnings must translate into measurable defensive improvements across both public institutions and private operators.

Public accountability is equally important. Americans have a legitimate interest in understanding whether disruptions affecting essential services arise from technical failures, criminal operations, or foreign interference. Accurate attribution protects public confidence by establishing responsibility through evidence rather than assumption. Federal agencies should provide timely, technically meaningful disclosures when doing so will not compromise active investigations or expose sensitive defensive capabilities. The public deserves clear information about confirmed threats, their operational consequences, and the actions being taken to prevent further damage.

The federal record already demonstrates that America’s digital and physical infrastructure is an active target of hostile foreign operations. The strategic priority is to prevent adversaries from converting unauthorized access into widespread operational disruption. Protecting critical infrastructure is not solely a cybersecurity responsibility; it is a national security obligation involving government, technology providers, industrial operators, and the institutions responsible for maintaining essential public services. The consequences of inadequate preparation will ultimately be borne by the American people.

---

---

Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Environmental Protection Agency (EPA), Department of Energy (DOE), and U.S. Cyber Command – Cyber National Mission Force (CNMF). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Joint Cybersecurity Advisory AA26-097A, April 7, 2026. (Free Download)

---

---

---

Federal Bureau of Investigation (FBI). North Korean Hackers Use Secretly Recorded Webcam Library of 900+ Tech Workers in $400M “FaceStealer” Crypto Theft Scheme. FBI FLASH AC-111226-MS, November 12, 2026. (Free Download)

---

---

---

Federal Bureau of Investigation (FBI), National Security Agency (NSA), and Cyber National Mission Force (CNMF). China-Linked Hacking Group QTFY Targets Military and Critical Infrastructure with Malicious Distributed Systems. Joint Cybersecurity Advisory JCSA-20260826-01, originally published August 26, 2026; updated September 2, 2026. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---