Iran-Linked Hackers Breach 30+ Minnesota Water Systems

CyberAv3ngers exploitation of exposed PLCs signals expanding operational-technology risk across US critical infrastructure.

Intelligence Lead

A coordinated weekend intrusion breached more than thirty water utilities across Minnesota beginning 26 July, in what state officials describe as one of the largest attacks on local water infrastructure in the state's history. US investigators are examining links to the Iran-affiliated persona CyberAv3ngers, with parallel intrusions reported in Michigan and at least five additional states. The activity followed a 22 July expansion of CISA Advisory AA26-097A, which had already flagged Iran-linked exploitation of internet-exposed programmable logic controllers across the water, energy, and manufacturing sectors.

Situation Report

Minnesota officials confirmed that the two-day intrusion, which began the weekend of 26 July, compromised remote monitoring and control systems at more than thirty water utilities statewide. Most confirmed cases involved programmable logic controllers (PLCs) manufactured by Rockwell Automation, Schneider Electric, and Siemens — the same three vendor lines named in the CISA update issued days earlier. Federal investigators, working alongside the FBI and state emergency management officials, are assessing whether the intrusions were centrally coordinated or represent parallel exploitation of a shared, publicly known vulnerability set.

The Cybersecurity and Infrastructure Security Agency's revised advisory, published 22 July, documented for the first time confirmed exfiltration of PLC project files by the threat activity it associates with Iran-affiliated operators, alongside detection guidance for manipulation of reusable code modules embedded in controller logic. That expansion arrived less than a week before the Minnesota intrusions began, a sequencing investigators are treating as evidentially significant rather than coincidental.

Reporting from multiple outlets indicates the CyberAv3ngers persona — previously assessed by US and allied cyber authorities as linked to Iran's Islamic Revolutionary Guard Corps — is the leading investigative hypothesis, though the US government has not issued a formal state-attribution statement as of this filing. Confirmed or reported intrusion activity has extended into Michigan, with officials in as many as seven states reviewing exposure. No utility has reported a disruption to treated water delivery or safety-critical process manipulation; the intrusions to date are assessed as reconnaissance and access-oriented rather than sabotage-executing.

CISA has renewed calls for water-sector operators to remove PLCs and other operational technology from direct internet exposure, specifically flagging undocumented cellular modem connections as a recurring blind spot even among utilities with mature cybersecurity programs.

Background & Context

CyberAv3ngers rose to prominence in late 2023 with attacks on Israeli-manufactured Unitronics controllers at US water utilities, an early demonstration that small municipal systems running commodity industrial control equipment could be reached and defaced with minimal technical investment. The group's toolset and targeting logic have since matured considerably, tracking the broader pattern of Iran-aligned cyber units treating US critical infrastructure as a low-cost, deniable pressure lever distinct from kinetic escalation.

The timing intersects with a fragile diplomatic track. Washington and Tehran signed a memorandum of understanding in June opening a sixty-day negotiation window covering the Strait of Hormuz and Iran's nuclear program, following hostilities that began in February. Cyber operations of this character have historically continued, and at times intensified, during periods of formal negotiation, functioning as a signaling channel that operates below the threshold likely to collapse talks outright.

Water and wastewater utilities remain the least-resourced segment of US critical infrastructure from a cybersecurity standpoint, with thousands of small systems lacking dedicated IT security staff. This structural gap has made the sector a persistent proving ground for state-linked actors seeking to demonstrate reach without crossing into confirmed sabotage.

Analysis & Assessment

The absence of confirmed process manipulation suggests the current phase remains access-establishment and signaling rather than an attempt to degrade water safety, though the documented exfiltration of PLC project files materially increases the risk of a follow-on manipulation attempt using accurate knowledge of each facility's control logic. Assessed with moderate confidence: the operational tempo and vendor-specific targeting closely track the CISA advisory's own findings, making a shared-actor or shared-toolkit explanation more plausible than independent, unrelated exploitation.

Should US authorities issue a formal state-attribution statement naming Iran, expect a proportionate but calibrated response — likely sanctions designations and possibly a classified or unclassified indictment — calibrated specifically to avoid disrupting the Hormuz negotiation track. A harder US response becomes more likely if any subsequent intrusion crosses from access to demonstrated disruption of a safety-critical process.

The broader trajectory favors continued low-intensity OT targeting of US water and energy infrastructure by Iran-aligned units through the length of the current negotiation window, used as a hedge against negotiation failure and a means of maintaining leverage without inviting direct military response.