The US government warns that Iranian state-backed hackers are actively breaking into and disrupting the industrial control systems of US water and energy suppliers. This new alert comes months after federal agencies warned of an escalation of hacking by Iranian actors amid the ongoing war.

In an advisory updated Wednesday, the FBI, NSA, Department of Energy and CISA said Iranian hackers were attacking programmable logic controllers on operational networks connected to the Internet, allowing them to manipulate data on their displays, causing outages and disruptions.

The Iranian hackers were initially found to be targeting controllers made by Rockwell, but the advisory has now expanded the types of industrial control systems attacked to include products from Schneider Electric and Siemens.

The agencies warn that “potentially all industrial control systems exposed to the Internet” may be affected and urge owners of critical infrastructure to take action. According to the advisory, Iranian-backed hackers were “conducting this activity to cause disruptive effects within the United States,” likely in response to the ongoing war between Iran, the United States, and Israel.

According to the FBI, hackers broke into a critical infrastructure provider and changed the programming logic of controllers to disable processes that handled critical shutdowns and alarms. The feds said this allowed “systems to enter unsafe conditions without notifying operators of the anomalies.”

This is the latest in a series of cyberattacks launched by Iranian government hackers and their proxies across the region since the start of the war in February.

The attacks range from the country’s typical espionage and hacking and leak operations, such as the leak of the contents of FBI Director Kash Patel’s personal email account, to more atypical destructive attacks that have caused large-scale damage or disruption. Among the most notable incidents was an attack on American medical technology giant Stryker, which allowed the Iranian hacking group “Handala” to remotely wipe tens of thousands of employee devices.

Handala also took credit for a data breach that affected California water supplier Cal Water in June and claimed it may have disrupted water supplies (without providing evidence). The water supplier said it saw no evidence of unauthorized access to its operational networks, which control the water supply.