One alert, three threats: how local agencies should have read the June 2025 Iran warning

The week

U.S. forces struck three Iranian nuclear sites on the night of June 21, 2025, after more than a week of Israeli strikes on Iran. On June 22, the Department of Homeland Security issued a National Terrorism Advisory System bulletin describing a heightened threat environment. It said low-level cyberattacks on U.S. networks by pro-Iranian hacktivists were likely and that cyber actors affiliated with Iran’s government might also conduct attacks. A ceasefire between Israel and Iran was announced on June 24. On June 30, CISA, the FBI, the Defense Department’s Cyber Crime Center and the NSA published a joint fact sheet. It warned that Iranian state-sponsored or affiliated actors might target vulnerable U.S. networks and devices, and urged operators of operational technology in particular to take specific defensive steps.

A heightened threat bulletin tends to produce a general response: more vigilance, more monitoring, a reminder email to staff. For state and local agencies, water and wastewater utilities and public safety organizations, that response is weaker than it looks. The June 2025 warning covered three different threats, carried out by different actors against different targets and stopped by different controls. We separate them into nuisance attacks by hacktivists, opportunistic intrusions into exposed operational technology, and targeted operations by state-affiliated actors. Sorting them tells an agency who owns each response and whether it is measured in hours, days or years.

Nuisance attacks: hours, and owned by communications

Pro-Iranian hacktivist groups have a long record of denial-of-service attacks on public websites, defacements and claims of data theft, some exaggerated or false. Within hours of the strikes, groups claimed denial-of-service attacks on U.S. targets, a pattern threat researchers tracked through the following days. These attacks are built for attention. They can take a county website offline for an afternoon or post a slogan on a public page. They rarely reach internal systems.

The defenses are well known and mostly contractual. Denial-of-service protection for public sites is usually available through the hosting provider or a content delivery network, and the time to confirm it is switched on is before an alert. Publishing rights for websites and social media accounts should be limited to named staff with multifactor authentication. The hardest part is communications. The common mistake is treating an unverified claim of a breach as confirmed. A holding statement drafted in advance, a quick technical check, and a named spokesperson who waits for that check will handle most incidents. This threat belongs to the communications director and the web team, not the security operations center.

Public safety agencies need one extra check. If a hacktivist group targets a city’s main website, residents may turn to 911 or non-emergency lines for information. Dispatch centers should know where to route those calls, and the city’s alert system should be ready to publish updates from a channel that does not depend on the affected site.

Opportunistic intrusions: days, and owned by public works

The second threat matters most to utilities and public works departments. In late 2023, actors that U.S. agencies linked to Iran’s Islamic Revolutionary Guard Corps compromised internet-exposed programmable logic controllers made by an Israeli company. Victims included a water authority in Pennsylvania. The attackers often used default passwords. Their success came from devices reachable from the internet with factory settings, not from sophistication.

The June 2025 fact sheet repeated the basic guidance: take operational technology off the public internet, change default passwords, require multifactor authentication for remote access and keep systems patched. For a small utility with one or two technical staff, the hard part is knowing which devices are exposed. CISA’s free vulnerability scanning service for public entities can identify internet-facing assets. So can a simple review of the remote access paths that integrators and equipment vendors set up during installation, which are often undocumented.

This is the one category where a bulletin should trigger a sprint. A list of exposed devices, an owner in operations for each, and a deadline measured in days will remove the easiest targets. The trade-off is operational. Pulling a controller off the internet may break a vendor’s remote support or an operator’s ability to check a pump station from home. Utilities should replace those paths with a managed remote access service that requires multifactor authentication, instead of restoring the exposure after the alert fades.

Monitoring matters as much as removal. Few small utilities watch their control networks for unexpected logins or setpoint changes. Basic alarms on remote sessions outside working hours, reviewed by the operator on duty, are cheap and catch the kind of tampering seen in 2023. State drinking water programs and utility associations can help small systems share that monitoring instead of building it alone.

Targeted operations: years, and owned by the CISO

The third threat comes from capable state-affiliated actors pursuing espionage, prepositioning or disruption against chosen organizations. Their operations are quiet and may not follow the news cycle. Agencies with defense, energy or emergency management roles, or deep federal partnerships, are more likely to be of interest than a typical municipal office. Even so, a small county can be a stepping stone to a state network it connects to.

Defenses here are slow to build and cannot be stood up in the week a bulletin appears. They start with phishing-resistant authentication for administrators and monitoring of privileged account use. Logs must be kept long enough to investigate an intrusion months after it began. Agencies also need relationships with state fusion centers and the MS-ISAC so that indicators arrive quickly. Managed service providers and integrators with remote access deserve particular attention, because a compromise of one provider can reach many local governments at once. Contracts should require multifactor authentication, documented access paths and prompt notice of incidents at the provider.

The mistake in this category is spending a heightened-alert week on activity that looks busy, such as extra all-staff emails, instead of checking whether logging would actually support an investigation. A useful test is to ask the security team to reconstruct one administrator’s sign-ins from six months ago. If it cannot, the investment priority for the next budget cycle is clear.

With hindsight

The ceasefire held through the summer of 2025, and the large-scale retaliatory campaign some feared against U.S. infrastructure did not materialize in that period. Hacktivist denial-of-service activity and claims of compromise did follow, consistent with the bulletin’s assessment. Federal agencies kept warning that Iranian actors might target exposed operational technology.

The support structure for local agencies also changed. On September 30, 2025, CISA’s cooperative agreement funding the MS-ISAC ended, and the center moved toward a paid membership model. Small governments that relied on free federal services had less to lean on in the next alert. That alert came when the United States and Israel began strikes on Iran in late February 2026, and familiar warnings about weak passwords and exposed devices returned. Agencies that used June 2025 to remove exposed controllers and default credentials did not have to repeat that work under pressure.