Iran-Linked Hackers Breach Water Systems Across Twelve US States

CyberAv3ngers intrusions triggered a Georgia pump station shutdown and boil-water advisory as the IRGC-linked campaign expands its footprint across US critical infrastructure.

Intelligence Lead

Iran-linked hackers, assessed to include the IRGC-backed CyberAv3ngers, have breached water-utility control systems across at least twelve U.S. states in recent weeks, with one intrusion in Georgia briefly disabling a pump station and triggering a boil-water advisory. The campaign is the broadest documented targeting of U.S. water infrastructure since the group's 2023 Unitronics intrusions, and it is unfolding alongside Iran's underground nuclear-site hardening and a stalled Gulf-mediated diplomatic push, indicating Tehran is applying pressure across military, cyber, and negotiating tracks simultaneously. No single intrusion has yet degraded water quality to a level endangering public health, though officials warn the sector's exposure remains high.

Situation Report

Reporting corroborated across NBC News, CBS News, and NPR identifies at least twelve affected states, including Michigan, Minnesota, Georgia, New Jersey, and South Dakota, with more than thirty community water systems impacted in Minnesota alone. The scope represents a significant broadening from earlier, narrower disclosures of Iranian-linked water-sector targeting.

The most serious confirmed impact occurred in Georgia, where hackers accessed and shut down a pump station, causing water pressure to drop and raising contamination risk. Local authorities issued a boil-water advisory for affected residents as a precaution. Officials have not reported any other jurisdiction experiencing comparable operational disruption to date.

The intrusions rely primarily on exploiting vulnerable programmable logic controllers, the industrial devices that monitor and control water-treatment and distribution processes. CyberAv3ngers, an IRGC-linked threat group active since at least 2023, has a documented history of targeting Unitronics PLCs left with default or unchanged credentials, a technique consistent with the current campaign's apparent methodology.

Iranian-linked activity has not been confined to water utilities. NBC News reporting citing U.S. sources describes parallel targeting of telecommunications and energy infrastructure in recent weeks, suggesting a coordinated effort to probe multiple sectors of U.S. critical infrastructure rather than an isolated water-sector operation.

Background & Context

CyberAv3ngers first drew sustained U.S. attention in late 2023 for a wave of intrusions against Unitronics Vision-series PLCs at water utilities, exploiting the devices' factory-default passwords rather than novel vulnerabilities. CISA and the FBI issued joint advisories at the time urging utilities to change default credentials and isolate control systems from the public internet, guidance the current campaign's continued success suggests remains inconsistently implemented across the sector.

The timing situates the campaign within a broader pattern of Iranian asymmetric pressure applied during periods of direct military confrontation with the United States. Tehran has historically favored infrastructure-focused cyber operations calibrated to demonstrate reach and impose cost without crossing thresholds that would invite major retaliation, a posture consistent with concurrent reporting on Iran's continued hardening of deeply buried nuclear facilities and a stalled Gulf-mediated push to restore regional oil flows.

The U.S. water sector remains a persistently soft target: it comprises thousands of small, often municipally run utilities with limited cybersecurity budgets and aging operational technology, a structural vulnerability that has drawn repeated warnings from CISA over the past several years.

Analysis & Assessment

The expansion to at least twelve states marks a clear escalation in scope compared with earlier disclosures, even as the technical sophistication of the intrusions appears unchanged. This pattern suggests Iranian-linked operators are scaling a known, low-cost technique against a large population of similarly misconfigured devices rather than developing new capability, a resource-efficient approach to sustaining pressure across many simultaneous targets.

The Georgia pump station incident represents the practical ceiling of demonstrated impact so far: disruptive and alarming to affected residents, but well short of a sustained, wide-scale public health emergency. Continued targeting across multiple states nonetheless signals intent to maintain visible pressure on U.S. homeland infrastructure while Iran's military and diplomatic tracks with Washington remain unresolved.

Parallel reporting of telecommunications and energy targeting warrants close monitoring. A confirmed shift of technique or intensity in those sectors, rather than continued reliance on default-credential PLC exploitation, would indicate a more deliberate escalation of Iranian cyber posture rather than opportunistic scaling of an existing campaign.