Iran's cyber warfare campaign appears to be entering a more dangerous phase, with hackers suspected of targeting everything from US water systems and oil tankers to food storage facilities in Europe.

Three separate cyber incidents have raised fresh concerns among security experts. In the US, operators of small-town water stations across the Midwest were locked out of their control systems. Two energy tankers heading towards Texas reportedly suffered network breaches while crossing the Atlantic. In Europe, hundreds of refrigerators at grocery stores were remotely pushed to temperatures as high as 49 degrees Celsius, damaging food supplies.

The attacks are suspected to have links to Iran, which cybersecurity experts say is becoming a more aggressive threat as its war with the US continues.

READ | France Says Iran's Guards Behind Cyberattacks On Supermarket Fridges

According to a report by The Wall Street Journal, Tehran is now expanding the range of its targets and moving beyond traditional cyber operations such as stealing information and spreading propaganda. Its suspected attacks are increasingly aimed at systems that control physical infrastructure, raising the possibility of damage in the real world.

Iran was once considered a relatively less sophisticated cyber power compared with China, Russia and North Korea. However, experts say the country is learning quickly and showing a growing willingness to use its capabilities against critical infrastructure.

"What Iran is doing right now is learning from the last war," Yossi Karadi, head of the Israel National Cyber Directorate, told the Journal.

"I always assume that my enemy in the next war won't be the same as the last one. It will be a better one."

READ | Why Iran Is In Spotlight After Water Systems Hacked In 7 US States

From Stealing Data To Disrupting Infrastructure

Iran began building its cyber capabilities in the early 2000s, with Israel emerging as its primary target. Over time, its operations expanded to include Gulf rivals such as Saudi Arabia and the United Arab Emirates. Attacks in the US, meanwhile, focused on Israeli-made equipment.

One major turning point came in 2010, when the Stuxnet computer worm was discovered. Developed by the US and Israel, the malware had infiltrated the control systems of Iranian nuclear centrifuges and forced them to destroy themselves.

The attack was widely seen as the first cyber operation to cause physical destruction. It also pushed Tehran to strengthen its own cyber programme.

READ | Iranian Hackers Suspected In Cyberattack On US' Minnesota Water Systems

Iran has since carried out several damaging operations. One of the most significant was the 2012 Shamoon attack, which wiped out tens of thousands of computers belonging to Saudi oil giant Aramco.

However, much of its activity remained relatively basic. Iran-linked hacker groups often stole personal information and released it publicly in what are known as 'hack and leak' operations. These attacks were designed to embarrass public figures, damage institutions and create panic.

Internet-connected surveillance cameras also became a target in more recent operations.

But American and Israeli officials believe Tehran is now focusing on more damaging techniques.

The Two Methods Raising Alarm

The first involves data-wiping attacks, which destroy important files and can leave computers unable to function.

The second is more concerning because it involves taking control of programmable logic controllers (PLCs). These devices are used to automate industrial processes and operate equipment across several sectors.

PLCs are part of operational technology (OT) systems, which connect digital commands to physical machinery. They are used in everything from traffic signals and sewage pumps to electricity networks, transport systems and manufacturing units.

READ | Why Iranian Hackers Are Emerging As A Threat To US Critical Infrastructure

In simple terms, hacking into these systems can allow attackers to interfere with the physical operations of essential services.

The Stuxnet attack on Iranian nuclear facilities used this very method.

According to Sergey Shykevich, director of threat intelligence at Israeli cybersecurity company Check Point, such attacks have become more common in recent years. He said they are frequently linked to a group called CyberAv3ngers, also known as Shahid Kaveh.

US Water Systems And European Food Supplies Targeted

CyberAv3ngers came under scrutiny in late 2023 after the US Cybersecurity and Infrastructure Security Agency (CISA) linked it to an attack on Israeli-made Unitronics systems used by US water management facilities.

Earlier this year, CISA issued another warning about Iranian cyber threats. The advisory was updated just days before water systems in at least seven US states were breached.

US officials are also investigating whether Iran was involved in attacks on two tankers travelling towards Texas in September.

READ | Home Addresses Of Over 2,000 US Marines Leaked By Iran-Linked Group: Report

The suspected campaign has also raised concerns in Europe. US and French officials believe Iranian hackers could be behind attacks on cold-chain storage facilities in France and other parts of Europe.

These facilities are responsible for keeping food and other goods at controlled temperatures. In the suspected attacks, refrigerators were remotely heated overnight, with temperatures reaching 49 degrees Celsius. The incidents led to food being spoiled and fires breaking out.

Several affected locations were supermarkets in smaller towns and rural areas. Cybersecurity experts believe such establishments can be easier to target than larger urban facilities, which may have stronger security systems.

Iran Denies Involvement

Tehran has rejected allegations that it is behind cyberattacks abroad.

Iran's ambassador to France, Mohammad Amin-Nejad, told the WSJ that if Iran had the capabilities being attributed to it, it would not use them against European countries. Instead, he suggested, the US or Israel would be more likely targets.

He also indicated that another country could be responsible for the attacks.

Why Iran's Cyber Strategy Matters

China, Russia, Iran and North Korea are considered the world's major cyber aggressors, but each has traditionally followed a different approach.

China generally focuses on espionage, quietly entering important systems and maintaining access that could prove useful during a future conflict.

Russia has often used cyberattacks to create disruption and chaos, particularly alongside its military operations.

North Korea, on the other hand, has relied heavily on cybercrime to generate money through theft and extortion.

Iran's approach has been different, although experts say its tactics are evolving.

Its technological capabilities may still be behind those of the other major cyber powers. However, its willingness to disrupt essential services and cause damage beyond computer networks is becoming a major concern.