Iranian attacks on US critical infrastructure puts 3,900 devices in crosshairs

Multiple CyberScoop reports describe an escalating, multi-faceted threat landscape: Censys and U.S. agencies warn of an Iranian government campaign targeting ICS/OT devices in U.S. energy, water and government environments (roughly 3,900 exposed devices reported), and a separate disruptive Iran-aligned activity tied to recent geopolitical events. U.S. law enforcement disrupted a Russia-linked GRU/APT28 router hijacking (Forest Blizzard/Operation Masquerade) that impacted ~18,000 devices and stole credentials/tokens. Researchers disclosed a Grafana prompt‑injection data‑exfiltration technique (