UK Issues Energy Sector Alert Following Iranian Cyber Attack on Power Plant

Power companies in the UK have been placed on high alert following a cyber attack by hackers linked to the Islamic Revolutionary Guard Corps (IRGC) that successfully shut down an energy site.

The incident occurred in July and is suspected to be the work of a group known as CyberAv3ngers, which is affiliated with the IRGC's electronic warfare arm and specializes in breaching critical infrastructure. The Department for Energy Security and Net Zero maintained that the attack targeted only a small plant and that the wider energy system was never at risk. However, the National Cyber Security Centre (NCSC), a branch of the signals intelligence agency GCHQ, responded by issuing a security alert to energy companies.

“In response to this specific incident, the NCSC and Department for Energy Security and Net Zero briefed energy CEOs and directly wrote to companies with advice, direction and next steps,” a departmental representative stated. “The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards.”

Michael Shanks, the Minister for Energy, emphasized that both the government and industry are taking the incident seriously, collaborating with regulators and the NCSC to assess ongoing threats and enhance protective measures.

Richard Moore, the former head of the MI6 overseas spy agency, warned that the UK faces persistent cyber threats from multiple states. Speaking to the BBC, he noted that a combination of China, Russia, Iran, and North Korea are all focused on cyber attacks against the UK and other democratic societies, underscoring the vital need for national resilience.

The IRGC's electronic warfare arm is led by Hamid Lashgarian, who was sanctioned by the US in 2024. The US government has offered a $10 million reward for information regarding his activities, noting that CyberAv3ngers operates under the IRGC’s Cyber-Electronic Command.

During their campaigns, the hackers have compromised Vision series programmable logic controllers (PLCs) manufactured by Israel-based Unitronic. These rugged industrial computers automate machinery, manufacturing lines, and critical infrastructure across sectors such as water and wastewater, energy, food and beverage, manufacturing, and healthcare.

A recent report by cyber security company Tenable revealed that CyberAv3ngers has repeatedly targeted small water utilities, municipal facilities, and rural energy operators. Tenable explained that this vulnerability is structural, stemming from organizations using remote access tools like TeamViewer or AnyDesk and exposing their PLCs directly to the public internet.