Western critical infrastructure is facing a simultaneous and qualitatively distinct wave of cyber threats from three state adversaries, each pursuing different strategic objectives but collectively placing energy grids, water systems and industrial networks under sustained pressure. The picture that emerges from intelligence reporting and cybersecurity analysis in early 2026 is not one of isolated incidents but of a hardening adversary posture timed to a period of elevated geopolitical tension.
The US Office of the Director of National Intelligence (ODNI) has formally identified China, Russia, Iran and North Korea as escalating cyber threats to US critical infrastructure, according to reporting by Industrial Cyber. What distinguishes the current moment from prior threat cycles is the growing focus on operational technology — the systems that directly govern physical processes such as water pressure, electricity generation and industrial machinery — rather than the conventional information technology networks that have historically been the primary target.
The three leading adversaries operate with distinct methods and timelines. China is assessed to be preparing rather than striking. Iran is striking now. Russia is doing both.
China is building latent access, not yet using it
Threat monitoring by CrowdStrike recorded a 150 per cent increase in China-linked cyber espionage activity across all sectors globally in 2024. In critical sectors specifically — financial services, media, manufacturing and industrial organisations — targeted attacks rose by as much as 300 per cent over the same period, according to analysis published by FalconFeeds.
Western intelligence agencies and leading cybersecurity firms assess that elite Chinese advanced persistent threat (APT) groups have shifted their primary objective. Data theft, long the signature ambition of Chinese cyber espionage, is no longer the main goal. The priority now is strategic pre-positioning — establishing durable, concealed access within critical infrastructure networks that can be activated at a moment of geopolitical crisis.
The methods favour stealth over speed. Chinese threat actors typically gain initial access by exploiting vulnerabilities in public-facing systems, then use living-off-the-land techniques — leveraging legitimate system tools rather than introducing detectable malware — and zero-day exploits to minimise their footprint, according to EclecticIQ's analysis of the escalating risk landscape in regional conflicts. The result is access that can lie dormant for months or years.
The assessed trigger for activation is direct conflict. Analysts judge that disruption operations linked to China-positioned access would most likely be initiated during a Taiwan contingency — a military confrontation involving the People's Republic of China (PRC) — with the disruption timeline assessed as extending beyond twelve months from the present. The precise extent of Chinese pre-positioning within specific networks has not been publicly disclosed, and whether any of this access has been used for active disruption prior to such a scenario is not confirmed in available reporting.
Iran is causing disruptions now
Where China's threat is latent, Iran's is active. US cybersecurity, law enforcement and intelligence agencies issued a joint advisory in April 2026 stating that Iranian hacking efforts targeting US critical infrastructure had intensified since the start of the year, driven by ongoing geopolitical tensions, Reuters reported.
Iranian hackers are targeting publicly accessible programmable logic controllers (PLCs) and supervisory control and data acquisition (SCADA) displays in government services, water and wastewater systems, and energy facilities. PLCs are the embedded computers that execute physical commands in industrial environments; SCADA systems provide the operator displays used to monitor and control those processes. The stated aim, according to the advisory, is to generate disruptive effects within the United States.
In some cases, those effects have materialised. Iranian campaigns have resulted in operational interruptions and financial setbacks, including manipulation of data files to alter display information and extraction of project data from devices. The specific organisations affected have not been publicly named, and the full financial and operational damage has not been quantified in available reporting.
A separate Iran-affiliated group, Handala — also tracked as Void Manticore and linked to Iran's Ministry of Intelligence and Security (MOIS) — employs a different attack surface. It uses virtual private network (VPN) credential theft and compromise of Microsoft's Intune device management platform to deploy wiper malware at scale against Israeli, US defence industry and Western enterprise targets, according to research published by the Cloud Security Alliance. The group exploits Group Policy — a standard Windows administration tool — to push destructive payloads simultaneously across large numbers of devices, weaponising the same management infrastructure organisations use for routine IT operations.
Russia integrates cyber attacks into a broader sabotage campaign
Russia presents what analysts describe as the most imminent operational risk to European critical infrastructure. The primary instrument is Sandworm, also tracked as APT44, a unit of Russian military intelligence assessed to have conducted confirmed operational technology-capable attacks against energy and water systems across European Union member states.
The cyber dimension is part of a larger pattern. Since 2024, Russia has recorded a fourfold increase in physical sabotage operations, with more than 150 hybrid warfare incidents documented across EU and NATO member states. In April 2025, pro-Russia hacktivists compromised a Norwegian dam — an incident that illustrates how cyber access to critical physical infrastructure has become a tool available not only to elite state units but to loosely affiliated actors operating under a broader Russian influence umbrella, EclecticIQ noted.
The integration of cyber operations into hybrid warfare — alongside physical sabotage, disinformation and economic pressure — distinguishes Russia's approach from the more compartmentalised operations of China and Iran. The objective is not solely disruption of a specific system but cumulative erosion of confidence in the reliability of infrastructure across adversary states.
Defenders across all three threat environments face a structural asymmetry. The management tools that make large IT environments efficient — device management platforms, remote access systems, administrative policy frameworks — are the same vectors being exploited for simultaneous, large-scale destruction. Security guidance, including from the Cloud Security Alliance, recommends that organisations implement privileged identity management and privileged access management (PAM) controls for administrative roles, requiring just-in-time approval for high-privilege actions such as mass remote wipe, as a baseline defence against wiper-based attacks.
What is not yet clear is how the three adversaries' activities interact. Each operates according to its own strategic logic and timeline. But the simultaneity of escalation — Chinese pre-positioning, Iranian operational disruption, Russian hybrid sabotage — leaves defenders needing to address supply chain exposure, identity and access control, infrastructure resilience and threat intelligence not in sequence but all at once.
Comments (0)