Critical Infrastructure

A timer, a length of copper wire, and a homemade rocket. That's what it takes to black out a substation, and German police just found the third such device in a week.

The Telegraph's report that Iran-linked hackers took a small UK power generator offline for four days in July has since been independently reported by the BBC, The Guardian, and The Independent. UK authorities still haven't confirmed it. Five US agencies just confirmed the broader threat is real.

Romania sits on the western edge of the Black Sea, the body of water separating it from Russia and Ukraine to the east. On August 20, two Romanian fighter jets destroyed an explosive-carrying drone about 80 nautical miles off Constanța, Romania's main Black Sea port, near an offshore gas platform called Neptun Deep. It was the fourth drone incident near Romania in three weeks, and the second at this exact platform.

A drought is quietly cutting how much cargo ships can carry through the Panama Canal.

Call this what it is: foreshadowing, not analysis. When a government publishes a legal case for striking something it hasn't struck yet, that's usually a sign of what comes next, not academic commentary.

Water pressure dropped and some plants flooded in Minnesota last week, when a coordinated attack cut operators off from the equipment that runs their own treatment systems. US investigators think Iran is probably behind it.

On the night of July 24, US Central Command announced no new strikes on Iran. That was the first pause after roughly thirteen consecutive nights of bombing since the ceasefire collapsed. President Trump said he doesn't think Iran is ready to make a deal, but that he's willing to listen, and both governments confirmed indirect talks are continuing. One day earlier, Iran had rejected a broader ceasefire proposal, brokered by Qatar, Egypt, Pakistan, and Turkey and delivered through Iraqi Prime Minister Ali al-Zaidi, that would have reopened both Hormuz shipping lanes for ten days while Washington and Tehran negotiated a longer-term arrangement. That is not the sequence of a side about to sign.

The Iran-linked campaign against US industrial control systems that surfaced this spring got worse on July 22. CISA (the federal cybersecurity agency), the FBI, and the EPA updated their joint advisory on Iran-affiliated hackers who have been breaking into the small industrial computers that run pumps, valves, and production lines, across water, energy, and government facilities, since at least March. Two things changed. The list of affected equipment grew to include Schneider Electric and Siemens controllers, on top of the vendors named in the spring, and some intrusions went further than disruption, modifying or deleting the controller logic itself and disabling safety shutoffs and alarms without alerting operators. NERC, the body that oversees grid reliability, said in the spring it was watching the grid closely, and nothing since suggests that's changed.

Coca-Cola told the SEC on July 16 that it had shut down all US production at Fairlife, its roughly $4 billion dairy brand, after a ransomware attack. Canadian production kept running. The company gave no timeline for restarting and did not name the attackers. The word in the filing that should hold a board's attention is "suspended." A ransomware attack, the kind of event most executives still file under "IT problem," stopped a physical production line at one of the largest beverage companies in the world.

A study out this month put a number on a supply-chain dependency few companies think to check. Chinese firms own, finance, or operate 78 of Africa's 231 commercial ports, and the control does not stop at the water's edge. It reaches into the software, the automation, and the artificial-intelligence systems that actually run them.

In May we told you the grid could pull the plug on your data center. This month the bill arrived, and data-center tenants are not the only ones paying it. Every business and household on the grid is.

Everyone games out a Chinese invasion of Taiwan. The scenario Taiwan itself just practiced is quieter, more likely, and would reach your business faster.

This has been the summer of the drone. Securing the FIFA World Cup, the FBI has detected more than 1,100 drones over stadiums and seized over 500, arresting operators from Houston to Dallas. A JetBlue crew even reported a suspected drone strike on approach to New York's JFK on June 29, though investigators later found no proof of a collision. The machines are everywhere, and the ones that should worry your business are not the ones over the ballgame.

The head of ASIO, Australia's domestic intelligence agency, used his annual threat assessment this month to describe a kind of breach that should change how you read the word. A foreign government's hackers had been inside an Australian critical infrastructure provider for months. They had not stolen data or sent a ransom note. They had taken the login credentials of the network's active users, including the IT staff guarding it, mapped the entire system, and quietly held on to their access. The purpose, ASIO concluded, was sabotage: "mapping out the network and maintaining access so they could cripple it at a time of their choosing."

The threat intelligence that feeds your security program has a supply chain, and three links in it just got thinner.

The security hardware meant to keep attackers out, and the outside firm hired to run a company's technology, are the two places monitoring rarely reaches. They are also where a patient intruder settles in for a year or more.

A transaction you signed, funded, and closed in Europe can now be reopened by a government up to five years later.

In the past month, three African countries enacted restrictions on raw mineral exports, and a regional bloc launched an initiative to spread the model across sixteen more. Mozambique passed a new mining law requiring 15 percent free state equity in all mining ventures and banning the export of unprocessed minerals. Mozambique is the world's third-largest graphite producer, a critical input for EV battery anodes. Zimbabwe banned all raw mineral and lithium concentrate exports in February, then in April granted conditional export quotas to six mines that committed to building domestic processing plants by January 2027 and paying a 10 percent export tax. The Democratic Republic of Congo, which produces more than 70 percent of the world's cobalt, reclassified lithium as a strategic mineral and raised royalties from 3.5 to 10 percent of gross revenue. The Southern African Development Community (SADC, the regional bloc covering 16 nations) launched a five-year, EU-funded initiative to build critical minerals processing capacity across six member states.

Data center power demand is outrunning what utilities can build. AI is the dominant new driver, layered on top of existing cloud and streaming growth. The Department of Energy has started giving grid operators emergency authority to curtail data centers before residential neighborhoods.

[Last week](https://stateofthethreat.com/weekly/2026-05-17) we said the Hormuz pass-through had arrived. This week three signals confirmed it is staying.

CISA's (the federal cybersecurity agency) Cyber Incident Reporting for Critical Infrastructure Act has been law since 2022. The implementing rule, the one that actually triggers compliance obligations, is expected any week. When it lands, approximately 316,000 entities across sixteen critical infrastructure sectors will have seventy-two hours to report covered cyber incidents to CISA. Twenty-four hours if they make a ransom payment. A covered incident is anything that substantially disrupts your operations, compromises your systems, or arrives through a compromised vendor. Non-reporters face DOJ (Department of Justice) referral, contempt proceedings, and suspension from government contracting.

Poland's internal security agency warned in early May that Russian-linked hackers breached the control systems at five municipal water treatment facilities and gained the ability to change how the equipment operates. In April, Sweden attributed a cyberattack against a thermal power plant to actors connected to Russian intelligence. Two NATO members, two types of critical infrastructure, the same adversary, within weeks of each other.

Nearly a dozen governments and their intelligence agencies published a joint advisory on April 23 naming what they found inside consumer-grade network equipment worldwide. The answer was the Chinese military.

A consortium backed by the Africa Finance Corporation, the African Development Bank, and the Italian government committed $1.3 billion in April to build 830 kilometers of rail connecting Zambia's copper belt to Angola's Atlantic port of Lobito. The project cuts transit time from over a month by truck to seven days by rail. Total cost is $5 billion. Ground breaks before the end of the year, with financial close expected Q4 2027 and freight moving by 2030.

Insurance closed the Strait of Hormuz before Iran's navy did. On February 28, 56 tankers transited normally. Within 72 hours, traffic fell to eight vessels. That happened before Lloyd's Joint War Committee (the body that designates conflict zones for the insurance market) redesignated the Arabian Gulf on March 3, before U.S. intelligence reported Iran planting naval mines by March 10, and before the first ship was seized on April 22.

Sulfuric acid is the reagent that processes copper ore, nickel, uranium, rare earths, and phosphate fertilizer. Nothing substitutes for it at industrial scale. The two major supply routes just closed simultaneously.

More than a thousand solar farms, wind installations, and battery storage sites must register with NERC (the federal body that enforces power grid reliability) by May 15 and comply with cybersecurity standards for the first time. Most have never had a federal compliance obligation of any kind. The reason this is happening now: in 2021, a single electrical fault at a Texas solar facility cascaded across installations 200 miles apart and knocked 1,100 megawatts offline in seconds. The facilities were not connected to each other. They failed the same way because they were built the same way, with identical inverter settings that no federal regulator had reviewed.

In March 2026, HMN Technologies (the successor to Huawei Marine, now owned by Hengtong Group) finished splicing 6,300 kilometers of new submarine cable across the Indian Ocean, extending the Pakistan-Egypt-Marseille PEACE system into Singapore. Three weeks later, on April 11, Chinese state-backed researchers tested a deep-water cable cutter rated to 3,500 meters. Same actor. Same body of water. Same month.

The first face-to-face talks between the United States and Iran since the 2015 nuclear negotiations lasted 21 hours and collapsed. VP Vance left Pakistan without scheduling a follow-up. Iran's parliamentary speaker said Tehran has "no trust in the opposing side." Hours later, Trump floated the idea of a full naval blockade on Iran.

Your security perimeter protects your network. The problem is how much of your business runs on infrastructure that isn't your network. Three stories this week exposed three versions of the same blind spot.

The White House proposed cutting CISA's budget by $491 million in FY2026 and another $707 million in FY2027. The combined effect eliminates more than a thousand positions and drops the agency from 3,400 people two years ago to under 2,500. Election security is gone entirely. Chemical facility security is gone. The Joint Cyber Defense Collaborative lost $14 million. There is no Senate-confirmed director.

On March 31, the Islamic Revolutionary Guard Corps published a list of 18 companies it designated as "legitimate military targets." The list included the companies that run most of American business technology: Microsoft, Google, Apple, Meta, Nvidia, Intel, Cisco, Oracle, Dell, HP, IBM, and Palantir. It also included JPMorgan Chase, Tesla, General Electric, Boeing, Abu Dhabi AI firm G42, and Dubai cybersecurity firm Spire Solutions, broadening the threat beyond tech to American financial, industrial, and regional partners. Amazon was not on the list. Its data centers had already been hit. The IRGC gave an 8 PM Tehran time deadline and warned employees to evacuate immediately.

Three research teams published findings in February and March 2026 that shrank the estimated resources needed to break widely used encryption by a factor of 20.

Last week we reported that Chinese-flagged vessels were passing freely through the Strait of Hormuz while commercial traffic fell to near zero. That was the assumption. The data tells a different story, and the real one is worse.

PJM Interconnection operates the largest power grid in the United States, serving 65 million people across 13 states from Illinois to Virginia. Every year, PJM holds a capacity auction where power generators bid to guarantee they can deliver electricity when demand peaks. The results set a baseline for what utilities charge customers.

Last week we reported that oil was near $99 a barrel and the Strait of Hormuz was under selective blockade. Both numbers got worse. On March 14, commercial traffic through the strait fell to zero. Brent crude, the international benchmark price for oil, is now trading between $106 and $119 per barrel, up more than 40% from $72 before the war began. Liquefied natural gas prices are up roughly 60%.

Last week we covered the opening salvo of Operation Epic Fury and Iran's unprecedented drone strikes on three AWS data centers. Two weeks in, the kinetic picture has shifted dramatically. The cyber picture has not.

Iran's Islamic Revolutionary Guard Corps, the regime's elite military branch, declared that "not a litre of oil" would pass through the Strait of Hormuz. The reality is more calculated than that.

On March 6, the White House released "President Trump's Cyber Strategy for America" alongside an executive order elevating cybercrime to the same priority level as nation-state threats. The document is four pages. It is worth reading in full.

Last week we said Iran's cyber restraint toward the US had ended. Seven days later, Israel collapsed Iran's internet to 4% in the opening salvo of a joint US-Israeli military campaign.

Norway says it faces its worst security situation since World War II. Finland arrested a ship's crew for severing an undersea cable on New Year's Eve. Both Russia and China are involved.

While nuclear talks were live, Iran pointed its cyber arsenal at dissidents and neighbors, not the United States. The US and Israel just bombed Tehran.

China isn't scouting your network anymore. They're inside the systems that control your operations.

Leaked documents show China isn't just probing infrastructure. They're rehearsing how to take it down.

Ninety-five percent of international internet traffic runs through cables on the ocean floor. State actors have been cutting them.