WASHINGTON — U.S. intelligence agencies are “urgently warning” private sector companies throughout the nation that Iranian actors “are conducting exploitation activity” that has resulted in “disruptions across several U.S. critical infrastructure,” according to a government notice reviewed by The Times.

The Iranian cyber activity comes as President Trump is threatening to target Iran’s critical infrastructure in the coming hours, particularly its bridges and power plants.

Iran’s attack targeted products by Rockwell Automation’s Allen-Bradley, one of the most widely used industrial automation brands, according to the notice, which said that cyber actors affiliated with Iran were exploiting “programmable logic controllers across U.S. critical infrastructure.”

Tehran’s targeting campaigns against U.S. organizations “have recently escalated, likely in response to hostilities between Iran and the United States and Israel,” the notice warned.

“Iran-affiliated advanced persistent threat (APT) actors are conducting exploitation activity targeting internet-facing operational technology (OT) devices, including programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley,” the notice reads.

“U.S. organizations should urgently review the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) in this advisory for indications of current or historical activity on their networks,” it continues.

The advisory was issued Tuesday jointly by the FBI, the Cybersecurity and Infrastructure Security Agency, the National Security Agency, the Environmental Protection Agency, the Department of Energy and Cyber Command.

Top executives from companies at the core of the nation’s ability to function — those leading America’s largest energy, water, transportation, and communications corporations — had already been taking it upon themselves to increase their vigilance over potential attacks, concerned that Trump’s willingness to target Iran’s critical infrastructure inadvertently put a mark on their backs.

Some fear Iran’s ability to conduct cyber operations that could take down transformers or power inverters, if not a wide-scale power system. Others are concerned about threats to brick-and-mortar sites from proxies of Tehran — physical attacks against facilities such as nuclear plants, or power management systems, the crown jewels of the sector.

Larger, even more capable actors, particularly Russia and China, may also take advantage of the fog of war to launch strikes themselves.

“There remains concern about Iranian cyber capabilities and retaliation if the U.S. carries through on threats to attack their infrastructure,” said Ernest Moniz, former U.S. secretary of energy under President Obama who helped negotiate the 2015 nuclear deal with Iran. “There may already be backdoors, Trojan horses and malware hidden in our infrastructure.”

“I have to believe that the government cyber experts — or what’s left of them — are working closely and indeed overtime with the power companies and other infrastructure operators on cyber defense and intrusion detection and warning,” Moniz added.

Iran has demonstrated an ability to penetrate networks tied to critical U.S. infrastructure before.

In 2015, Iran-backed hackers accessed data associated with Calpine Corp., one of California’s largest power producers, obtaining detailed engineering diagrams and credentials related to power plant systems. Some were labeled “mission critical.” U.S. officials feared at the time that the breach would allow Tehran to initiate blackouts nationwide.

Since that time, companies at the center of the U.S. energy and telecommunications sectors have markedly improved their defenses. But Iran’s offensive capabilities have improved, as well.

Large players in the energy sector are operating with “a watchful eye and an elevated posture right now,” said Pedro J. Pizarro, president and chief executive officer of Edison International, the parent company of Southern California Edison, one of the nation’s largest electric utilities.

Companies like Edison have been operating under persistent threat for over a decade. In 2024, a pair of devastating cyber espionage attacks targeting U.S. critical infrastructure attributed to Chinese hackers, Volt Typhoon and Salt Typhoon, were discovered after avoiding detection for at least three years.

The threat of a similarly latent attack — in which malware lies dormant in critical infrastructure systems, waiting for a signal to activate — is a real cause for concern in the sector, despite its best efforts and technological advances, experts and insiders said.

“The threat of cyber and physical attacks targeting critical infrastructure is not new,” said Jennifer DeCesaro, senior vice president of industry operations at the Edison Electric Institute, “which is why we partner with the government through the Electricity Subsector Coordinating Council to share actionable intelligence and prepare to respond to incidents that could affect our ability to provide electricity safely and reliably.”

The ESCC works closely with the National Security Council and its intelligence arms, particularly the intelligence agencies and Cybersecurity and Infrastructure Security Agency, or CISA, to coordinate regular briefings on safety standards, best practices and intelligence tips.

The CIA declined to comment. A spokesperson with CISA, listed as out of office due to the ongoing federal funding hiatus for the Department of Homeland Security, could not be reached for comment.

Last summer, announcing a 40% cut to the workforce of her office, Director of National Intelligence Tulsi Gabbard eliminated the Cyber Threat Intelligence Integration Center, previously seen as a critical fusion hub of information by private sector partners.

Asked to respond to the potential of retaliatory attacks against U.S. infrastructure, Karoline Leavitt, the White House press secretary, repeated the president’s threats.

“The Iranian regime has until 8PM Eastern Time to meet the moment and make a deal with the United States,” she said. “Only the president knows where things stand and what he will do.”

Trump has threatened to destroy every bridge and power plant in Iran if they fail to come to an agreement that ends its control over the Strait of Hormuz.

Ultimately, corporate executives shoulder much of the burden as the first line of defense for the country’s critical infrastructure, roughly 85% of which is owned by private sector companies.

Tom Fanning, former chief executive officer of Southern Co. and now executive committee chairman at the Alliance for Critical Infrastructure, said the threat from Iran is “credible.”

“I have not seen what I would describe as the existential threat, to take down a wide-ranging power system,” Fanning said. “Could those things be turned on? Sure. Is the United States critical infrastructure prepared to act? I think so.”

Last month, early on in the war, the Los Angeles Metro transit system was forced to shut down a portion of its network due to a hack. Authorities say it is still unclear who was behind the breach, but a source told The Times that Iran-backed hackers are being investigated as the potential culprit.

The transportation agency said its security team had “discovered unauthorized activity,” and were making sure its roughly 1,400 servers were secure before bringing them back online. The agency has emphasized the hack did not impact passengers’ commute time.

The FBI said it was aware of the hack. Homeland Security is working with local partners “to address cyber threats to critical infrastructure,” an official said.

“The reality is that the threats are here and now,” Fanning added. “The truth is, the bad guys are already here.”

Times staff writers Kevin Rector, Richard Winton and Rebecca Ellis, in Los Angeles, contributed to this report.

Rep. Ilhan Omar, D-Minn., called President Donald Trump an “unhinged lunatic” in a Monday post on X, advocating for him to be ousted from office.

“This is not ok. Invoke the 25th amendment. Impeach. Remove. This unhinged lunatic must be removed from office,” she asserted.

The left-wing lawmaker made the comments while sharing a screenshot of the president’s controversial Easter Sunday Truth Social post threatening attacks against Iranian power plants and bridges.

TRUMP WARNS IRAN HE MAY STRIKE ‘EVERY POWER PLANT’ AS DEADLINE TO REOPEN HORMUZ NEARS

“Tuesday will be Power Plant Day, and Bridge Day, all wrapped up in one, in Iran. There will be nothing like it!!! Open the F[—]in’ Strait, you crazy bastards, or you’ll be living in Hell – JUST WATCH! Praise be to Allah,” Trump wrote in the post, referring to the Strait of Hormuz. 

Sen. Mark Kelly, D-Ariz., warned in a Monday post on X, “Threatening to target power plants and other non-military targets is not strength. If those words become orders to destroy civilian infrastructure with no valid military purpose, it’s hard to see how they would not violate the laws of armed conflict. America leads best with strength, discipline, and professionalism. Illegal orders to make civilians suffer would be a black mark on our military and our country.”

MARK KELLY PRESSED ON WHETHER HE WOULD REFUSE ORDERS IF HE WAS STILL IN UNIFORM

Sen. Jeff Merkley, D-Ore., declared in a Sunday post on X, “President Trump’s profanity-laden Easter threat to attack Iran’s civilian infrastructure—power plants and bridges—are the words of a frustrated and immoral madman. Many experts agree that such attacks would be war crimes under international law. To our military leaders, remember this: You are legally required to refuse orders to commit war crimes.”

Sen. Bernie Sanders, I-Vt., characterized Trump’s comments as “the ravings of a dangerous and mentally unbalanced individual,” asserting in a Sunday post on X, “Congress has got to act NOW. End this war.”

Fox News Digital reached out to the White House for comment early Tuesday morning.

‘GOD IS GOOD’: INSIDE THE HIGH-RISK US MISSION TO SAVE A WOUNDED AIRMAN SHOT DOWN IN IRAN

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

During remarks on Monday, Trump indicated the U.S. has “a plan … where every bridge in Iran will be decimated by 12 o’clock tomorrow night, where every power plant in Iran will be out of business, burning, exploding, and never to be used again, I mean complete demolition by 12 o’clock.”

“We don’t want that to happen,” he said.

CNN will host a California gubernatorial primary debate May 5.

The two-hour debate will take place at 6 p.m Pacific time at a venue in the Los Angeles area that is yet to be determined. CNN anchors Elex Michaelson and Kaitlan Collins will serve as moderators.

The debate will air live across CNN, CNN International, CNN en Español and, for viewers without cable, on CNN’s subscription streaming service.

Participating candidates must have at least 3% support among likely primary voters in two state polls or an average of 3% across two polls that meet CNN’s methodology standards. The polls must be released between Feb. 1 and April 27.

The candidates must also have raised, contributed or lent to their campaigns at least $1 million, based on publicly available data from the California secretary of state.

Candidates from both parties are eligible to participate due to California’s “jungle primary” system, in which all candidates appear on the same ballot regardless of political affiliation. The top two finishers advancing to a November runoff, even if they are both from the same party.

Two Republicans, conservative commentator Steve Hilton and Riverside County Sheriff Chad Bianco, are the leading candidates, according to a poll released Wednesday by UC Berkeley’s Institute of Governmental Studies and co-sponsored by The Times.

The poll showed six Democratic candidates currently qualifying for the debate under CNN’s standards: U.S. Rep. Eric Swalwell, former House Rep. Katie Porter, philanthropist Tom Steyer, former U.S. Secretary of Health and Human Services Xavier Becerra, former state Assembly Speaker Antonio Villaraigosa and San José Mayor Matt Mahan.

CNN typically does not carry debates involving candidates in statewide races, but the network believes that the California contest is significant enough for a national platform.

“One out of approximately every eight Americans lives in the Golden State and it is at the forefront of some of the most complex challenges of our time,” said David Chalian, CNN’s political director and Washington bureau chief. “California’s jungle primary system also allows for the debate to include a wide spectrum of viewpoints and proposals to tackle those challenges that will reverberate across the country in this pivotal election year.”