jain.com — data centers, connectivity and security, analyzed daily

Tag: critical infrastructure security

  • Hack-Back Memo Puts State Hackers Out of Scope, Despite Attacks on 45 Water Systems

    Hack-Back Memo Puts State Hackers Out of Scope, Despite Attacks on 45 Water Systems

    TL;DR · 30-second read

    The Short Version

    The American government will now let approved private companies break into, and even wreck, computers run by foreign criminal hacking gangs. In March, officials said they would not do this.

    Each company must set aside at least $1 million, which it loses if it breaks the rules. Every attack needs written approval from the Justice Department and Homeland Security.

    The catch: hackers working directly for a foreign government are off-limits. That matters because the order came after suspected Iranian attacks on water suppliers in 45 American towns.

    Tom’s Hardware reported that President Donald Trump signed a presidential memorandum on August 12 creating the first US program that lets vetted private companies conduct offensive cyber operations against foreign cybercrime organizations. These include operations that destroy data and systems. Participating firms must post at least $1 million in escrow, which they forfeit if they break program rules. Every operation needs written approval from Department of Justice and Department of Homeland Security officials.

    A National Coordination Center will run the program. Implementation guidance is due within 60 days. The policy reverses public statements administration officials made in March.

    Executive Summary

    The memorandum authorizes two kinds of activity. “Cyber Surveillance Operations” means getting into foreign systems without permission to gather intelligence while staying undetected. “Cyber Effects Operations” means disrupting or destroying those systems and their data. Both large firms and smaller specialists will be eligible. Participants may also sign commercial deals with other private firms and with state and local agencies to receive threat data and propose operations based on it.

    This matters for two reasons. First, it turns offensive cyber activity, long treated as a government monopoly in the US, into something a licensed private sector can do under supervision. Second, its target definition is narrow. A group qualifies as a target unless “clear intelligence exists” that it is part of a foreign government or wholly run at a government’s direction. So the program is aimed at criminal ransomware crews, not at the state-directed actors behind many attacks on physical infrastructure. For operators of water, power and data center infrastructure, that distinction shapes what the program can and cannot do for them.

    The Target Line Runs Straight Through Critical Infrastructure

    The memo arrived after suspected Iranian cyberattacks on water suppliers in 45 US municipalities. It also followed a CISA alert about Iranian hackers targeting programmable logic controllers (PLCs), the small industrial computers that open valves, run pumps and switch equipment at water and energy companies. Yet state-directed hackers fall outside the program’s own definition of a valid target. Private operators could go after a ransomware crew that encrypts a utility’s billing systems. They could not go after a government-run unit tampering with its treatment-plant controllers.

    The line is drawn deliberately. Ransomware crews that operate with a state’s tolerance but not under its formal control stay within scope, a description that fits much of the Russia-based ransomware ecosystem. Once an actor is clearly an arm of a foreign state, the matter stays with government. For utility and industrial security teams, the practical conclusion is that nothing changes for defending operational technology against nation-state intrusion. Segmentation, monitoring and incident response for control systems remain their responsibility. The new program targets the financially motivated threat, not the geopolitical one.

    There is also an ambiguity problem. Eligibility turns on whether “clear intelligence” ties a group to a government, and in practice attribution is often contested and slow. A group judged criminal today may later prove to have state links. That question will matter a great deal to any firm whose operation lands on the wrong side of the line.

    A $1 Million Bond on a Destructive Capability

    The escrow requirement is the program’s main economic control. A minimum of $1 million, forfeited for rule-breaking, is a meaningful commitment for a small specialist firm. Whether it is proportionate to the harm a destructive operation could cause is a separate question. Wiping servers that turn out to be shared with innocent third parties could produce losses well above that figure. The minimum works as a deterrent and an entry filter. It is not obviously a compensation fund.

    The commercial provisions may matter more for the market’s shape. Participants can contract with other private firms and with state and local agencies, receive threat data and propose operations based on it. That creates a potential new service line for security vendors: selling disruption, not just detection. Two background facts point the same way. Congress earmarked $1 billion for offensive cyber operations in last year’s spending bill. Google said in August last year that it was preparing to take part in disruptive actions against cybercriminals. Large platform companies with deep telemetry into criminal infrastructure look like natural participants. Smaller firms may compete on specialized tasks, as the eligibility rules anticipate.

    Escalation, Legal Exposure and a Classified Annex

    DOJ and DHS officials cannot approve operations likely to cause loss of life or amount to an armed attack under international law. The memo does not prohibit such operations outright, however. Approval authority for them sits in a classified annex. Companies weighing participation, and the public, therefore cannot see the full rulebook for the highest-risk cases.

    Personnel face exposure too. Jake Williams, vice president of research and development at Hunter Strategy, told TechCrunch that Americans involved in these operations “could easily be classified as non-uniformed combatants while traveling overseas.” That is a risk that falls on individual employees, not only on their employers, and firms will need to account for it in staffing, travel policy and insurance.

    The speed of the reversal adds uncertainty. In March, Thomas Lind, then a senior adviser at the Office of the National Cyber Director, said the administration had no plans to authorize private offensive operations: “We’re not interested in fighting pirates with pirates.” National Cyber Director Sean Cairncross said the same week that companies running offensive campaigns were not what the administration meant when it asked industry for help. A policy that changed direction within months could change again, which makes long-term investment in offensive capability a harder bet.

    Collateral Risk Is Written Into the Rules

    The memo requires any company that unintentionally hits a US person or a system on US soil to halt operations and notify the government immediately. That clause concedes that operations aimed abroad can land at home. Criminal groups commonly route activity through rented servers and compromised machines owned by unrelated parties. Hosting providers, cloud platforms and data center operators therefore have a direct interest in how approvals weigh that possibility, and in how quickly they would be told if their infrastructure were affected.

    Defenders more broadly face a quieter risk: retaliation. A criminal group whose systems are destroyed by a US firm may not distinguish between that firm and US targets generally. The memo’s safeguards govern how operations are approved. They do not change who absorbs the response.

    Background

    For decades, US law and policy have treated breaking into someone else’s computer as illegal, even when that someone is an attacker. Offensive cyber operations have been reserved for government agencies such as the military and intelligence community. Proposals to let private victims “hack back,” including the Active Cyber Defense Certainty Act introduced in Congress in 2017, never became law. Critics warned of misattribution, collateral damage and escalation.

    Pressure grew as ransomware crews, many operating from jurisdictions beyond the reach of US law enforcement, hit hospitals, pipelines and municipalities. Some large technology firms have already worked with authorities to take down criminal infrastructure, and Google said last year it was preparing to take part in disruptive actions. The August 12 memorandum is the first formal framework for private firms to go further, under federal supervision.

    Sources

    Source: White House authorizes private companies to launch ‘hack-back’ cyberattacks that destroy data and systems, targeting foreign cybercrime organizations. Tom’s Hardware on the August 12 presidential memorandum creating a supervised private offensive cyber program.

  • Iran-Linked Spear-Phishing Campaign Targets US and Allied Critical Sectors

    Iran-Linked Spear-Phishing Campaign Targets US and Allied Critical Sectors

    Hackers linked to Iran are targeting key sectors in the United States and allied countries with sophisticated spear-phishing messages, according to reporting published by Cybersecurity Dive on May 23, 2026. Spear-phishing — fraudulent messages tailored to a specific person or organization to steal credentials or deliver malware — remains one of the most reliable entry points for state-aligned intrusion campaigns.

    The report frames the activity as state-actor tradecraft aimed at strategically significant sectors across the US and its allies, placing it in the long-running pattern of Iran-linked cyber operations against Western targets.

    Executive Summary

    The announcement, as reported, is narrow but consequential: an Iran-linked threat campaign is actively working email inboxes across key US and allied sectors, using spear-phishing messages described as sophisticated. Unlike bulk phishing, spear-phishing is researched and personalized — attackers study a target’s role, contacts, and current projects, then craft a message plausible enough that a careful professional might still click.

    Why it matters: for operators of critical infrastructure — data centers, networks, energy, government suppliers — the initial access vector in most serious intrusions is not an exotic zero-day exploit but a person and a login. A state-aligned campaign that invests in convincing lures is a direct test of an organization’s identity controls, email defenses, and staff vigilance. The report is a signal to treat inbound-message risk as a board-level infrastructure issue, not a routine IT nuisance.

    It is worth being clear about what is and is not established by the source available at publication: the headline-level report attributes the campaign to Iran-linked actors and characterizes the targeting and technique, but the public details we have do not enumerate specific victim organizations, confirmed breaches, or the precise malware involved. Our analysis below works within those limits.

    Why Spear-Phishing Still Opens the Door

    Spear-phishing endures because it attacks the one system that cannot be fully patched: human judgment. A tailored message that appears to come from a known vendor, a regulator, a recruiter, or a colleague converts trust into access. Once a target enters credentials on a look-alike page or opens a weaponized attachment, the attacker inherits a legitimate identity inside the network — often bypassing perimeter defenses entirely, because from the system’s point of view a real user has simply logged in.

    The economics favor the attacker. Crafting a convincing lure costs a state-backed team hours; defending against every possible lure costs an enterprise a layered program of email filtering, authentication hardening, and continuous training. That asymmetry is why campaigns of this type recur year after year, and why the reported sophistication matters: better-crafted lures defeat the pattern-matching — both human and automated — that catches commodity phishing.

    Critical Infrastructure in the Crosshairs

    The reported targeting of key US and allied sectors fits the established logic of state-aligned operations. Nation-state actors pursue two broad goals against infrastructure-adjacent organizations: intelligence collection — reading email, mapping networks, harvesting credentials for later use — and pre-positioning, meaning quiet footholds that could be activated during a future geopolitical crisis. Iran-linked groups have been publicly documented over the past decade conducting both kinds of activity against Western government, energy, telecommunications, and defense-industrial targets, which is the context in which a report like this lands.

    For the infrastructure sector specifically, the supply chain widens the aperture. A data center operator, carrier, or managed-service provider is valuable to an attacker not only for its own systems but as a stepping stone into hundreds of customers. That makes vendors and operators in this industry disproportionately attractive spear-phishing targets — and makes their security posture a shared-fate issue for everyone downstream.

    What “Sophisticated” Should Trigger in a Defense Program

    Labels like “sophisticated” appear in nearly every threat report, so the practical question is what a defender should change. The durable answers are structural rather than heroic. Phishing-resistant multi-factor authentication — hardware security keys or platform passkeys rather than SMS codes or push approvals — removes most of the value of a stolen password. Strict email authentication (the SPF, DKIM, and DMARC standards that let receiving servers verify a sender’s domain) narrows spoofing room. Network segmentation and least-privilege access limit how far a single compromised account can travel.

    Equally important is the reporting culture: organizations that make it easy and blame-free for staff to flag a suspicious message convert their workforce from the weakest link into a distributed sensor network. State-actor campaigns are rarely stopped by one control; they are stopped by several mediocre days for the attacker in a row. The measured takeaway from this report is not alarm but prioritization — inbox-borne identity attacks remain the front line, and budgets should reflect that.

    Background

    Cyber operations linked to Iran have been a fixture of the threat landscape since at least the early 2010s, with publicly documented campaigns against Western banks, energy companies, government agencies, and defense contractors. Spear-phishing has consistently served as the entry technique of choice for these operations, because it is cheap, deniable, and effective against organizations of any size. Periods of geopolitical tension between Iran and Western governments have historically coincided with upticks in reported activity.

    For the infrastructure industry, the relevant history is the steady shift of state-actor attention toward operators — data centers, carriers, utilities, and managed-service providers — whose networks connect to many downstream customers. US and allied governments have repeatedly warned critical-infrastructure operators to assume they are targets and to harden identity and email defenses accordingly; the May 2026 reporting fits squarely within that ongoing advisory pattern.

    Source: Iran-linked hackers target key US, allied sectors with sophisticated spear-phishing messages — Cybersecurity Dive report, May 23, 2026, on a state-linked email campaign against US and allied organizations.