Nation-State Cyber Attacks Targeting North America's Critical Infrastructure

Executive Summary

In early 2026, nation-state cyber actors have intensified their operations against North America's critical infrastructure, targeting sectors such as energy, water utilities, healthcare, and financial services. These attacks underscore the escalating threat to national security and economic stability.

Recent Incidents

• Stryker Corporation Attack: On March 12, 2026, pro-Iranian hackers, operating under the group name "Handala," launched a cyberattack against Stryker Corporation, a U.S.-based medical device company. This attack is believed to be in retaliation for alleged U.S. actions in Iran. The hackers targeted critical infrastructure, including defense contractors, water plants, power stations, and healthcare facilities, aiming to disrupt U.S. operations and exert economic and psychological pressure. (apnews.com)

• St. Paul Cyberattack: In July 2025, the city of St. Paul, Minnesota, experienced a significant cyberattack that led to the deployment of the state's National Guard and a declaration of a state of emergency. The attack disrupted core city systems, including internal networks, online payment portals, and public Wi-Fi. The group "Interlock," a sophisticated ransomware-as-a-service organization, claimed responsibility and released 43 gigabytes of stolen data after the city refused to pay the ransom. (en.wikipedia.org)

• Moore County Substation Attack: In December 2022, two electrical distribution substations in Moore County, North Carolina, were attacked, leaving up to 40,000 customers without power. The attack resulted in the death of one individual and prompted local authorities to declare a state of emergency and curfew. While the perpetrators' identities remain unknown, the incident highlights the vulnerability of critical infrastructure to cyber and physical attacks. (en.wikipedia.org)

Attribution and Threat Actors

The recent attacks have been attributed to various nation-state actors:

• Iranian Cyber Actors: The "Handala" group, linked to Iran, has been active in targeting U.S. infrastructure, including defense contractors and critical utilities, as part of a broader strategy to hinder U.S. operations and exert pressure. (apnews.com)

• Chinese Cyber Actors: The group known as "Volt Typhoon," attributed to the Chinese government, has been identified as an advanced persistent threat (APT) targeting U.S. critical infrastructure, focusing on espionage and data theft. (en.wikipedia.org)

Implications for Critical Infrastructure

The targeting of critical infrastructure by nation-state actors poses significant risks:

• Operational Disruptions: Cyberattacks can lead to service outages, as seen in the St. Paul and Moore County incidents, affecting essential services and public safety.

• Economic Impact: Disruptions in critical sectors, such as energy and healthcare, can lead to substantial economic losses and undermine public trust.

• National Security: Attacks on critical infrastructure can compromise national security by targeting defense contractors and other sensitive entities.

Recommendations

To mitigate the risks associated with nation-state cyberattacks on critical infrastructure, the following measures are recommended:

• Enhanced Cyber Hygiene: Organizations should implement robust cybersecurity practices, including regular system updates, employee training, and incident response planning.

• Collaboration and Information Sharing: Government agencies and private sector entities should collaborate to share threat intelligence and best practices.

• Investment in Cybersecurity: Increased investment in cybersecurity infrastructure and personnel is essential to defend against sophisticated cyber threats.

Conclusion

The recent cyberattacks attributed to nation-state actors highlight the critical need for enhanced cybersecurity measures to protect North America's infrastructure. Proactive strategies and collaborative efforts are essential to mitigate the evolving cyber threat landscape.

Highlights:

• Iran-linked hackers take aim at US and other targets, raising risk of cyberattacks during war, Published on Thursday, March 12