Iranian-affilited hackers may target US companies and critical infrastructure operators, particularly defence organisations with holdings or relationships with Israeli research and defence firms, according to an advisory from US government officials on Monday.

The FBI, National Security Agency, the Department of Defence Cyber Crime Centre (DC3) and the Department of Homeland Security’s civilian cybersecurity defence wing said in a statement, issued alongside the advisory that while there are no indications of a coordinated Iranian-linked malicious cyber campaign so far, organizations should ensure their defenses are up to date.

“Despite a declared ceasefire and ongoing negotiations towards a permanent solution, Iranian-affiliated cyber actors and hacktivist groups may still conduct malicious cyber activity,” the agencies said in the advisory.

Cybersecurity researchers and defenders in Israel and the US have so far seen little Iranian-linked cyber activity of consequence in the wake of the war launched by Israel on June 13, followed by US strikes on Iranian nuclear facilities on June 22.

Iranian state-sponsored hackers are known to exploit existing vulnerabilities in unpatched or outdated software and compromise internet-connected accounts and devices that use default or weak passwords, as well as work with ransomware operators to encrypt, steal and leak sensitive information, the agencies said on Monday.

In November 2023, hackers said by the US government to be affiliated with the Iranian Revolutionary Guards, hacked equipment located in water and wastewater treatment systems in multiple states.

The attacks targeted an Israeli-made device and came shortly after the October 2023 Hamas attacks on Israel.