Unnamed Oil & Gas Firms: Iran-linked cyberattack targets critical field logic controllers

Iran-Linked Cyberattack Targets Oil & Gas Operational Technology

On 1 April 2026, during the 18th InCyber Forum in Lille, France, a U.S. government notice alerted oil and gas firms to an ongoing cyberattack targeting operational technology (OT) controllers. The attack, attributed to Iran-linked threat actors, specifically compromised field logic controllers (FLCs), which are critical to industrial control systems in energy infrastructure.

The incident highlights escalating cyber threats to the sector, particularly as the industry undergoes a transition to cleaner energy sources. While details on the attack’s scope and impact remain limited, the warning underscores vulnerabilities in OT environments, which manage physical processes like drilling, refining, and pipeline operations.

The alert follows a pattern of state-sponsored cyber activity targeting global energy infrastructure, raising concerns about potential disruptions to supply chains and operational safety. The InCyber Forum, a key international cybersecurity event, served as the backdrop for the disclosure, emphasizing the growing intersection of cyber risks and critical energy systems.

Source: https://www.upstreamonline.com/energy-security/iran-linked-cyberattack-targets-critical-field-logic-controllers/2-1-1970502

InfraShield cybersecurity rating report: https://www.rankiteo.com/company/infrashield-com

"id": "INF1775622727",
"linkid": "infrashield-com",
"type": "Cyber Attack",
"date": "4/2026",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"

{'affected_entities': [{'industry': 'Energy', 'type': 'Oil and gas firms'}],
 'attack_vector': 'Operational Technology (OT) controllers',
 'date_detected': '2026-04-01',
 'date_publicly_disclosed': '2026-04-01',
 'description': 'A U.S. government notice alerted oil and gas firms to an '
                'ongoing cyberattack targeting operational technology (OT) '
                'controllers, specifically field logic controllers (FLCs), '
                'attributed to Iran-linked threat actors. The incident '
                'highlights escalating cyber threats to the energy sector, '
                'particularly as the industry transitions to cleaner energy '
                'sources.',
 'impact': {'operational_impact': 'Potential disruptions to drilling, '
                                  'refining, and pipeline operations',
            'systems_affected': 'Operational technology (OT) controllers, '
                                'field logic controllers (FLCs)'},
 'motivation': 'State-sponsored, potential disruption to supply chains and '
               'operational safety',
 'references': [{'date_accessed': '2026-04-01',
                 'source': 'U.S. government notice'},
                {'date_accessed': '2026-04-01',
                 'source': '18th InCyber Forum'}],
 'threat_actor': 'Iran-linked threat actors',
 'title': 'Iran-Linked Cyberattack Targets Oil & Gas Operational Technology',
 'type': 'Cyberattack',
 'vulnerability_exploited': 'Field logic controllers (FLCs)'}