In an advisory issued last week, ICS-CERT said it has received information about targeted attacks and intrusions into multiple organizations over the past several months.
The attacks are related to a single campaign and appear to have started in late December 2011, the advisory noted. "Analysis shows that the spear-phishing attempts have targeted a variety of personnel within these organizations; however, the number of persons targeted appears to be tightly focused," the ICS-CERT said.
"In addition, the e-mails have been convincingly crafted to appear as though they were sent from a trusted member internal to the organization," it said.
ICS-CERT is currently working with multiple organizations to determine the scope of the attack activity and to discuss mitigation measures. It has also conducted a series f briefings with infrastructure asset owners around the country to share information on the attacks, the advisory noted.
The Christian Science Monitor, which was the , quoted unidentified sources as saying that the U.S. Department of Homeland Security (DHS) has so far released at least three confidential "amber" alerts warning gas pipeline companies about the attacks.