Security researchers at Tenable suspect the Iran-linked faux hacktivist outfit CyberAv3ngers was behind the cyberattack that disrupted more than 30 Minnesota water facilities.
Neither state-level nor federal officials have made any claims regarding attribution for the attacks, however, Tenable reckons the operational pattern is consistent with the crew's previous raids, noting the timing relative to recent government warnings.
The Cybersecurity and Infrastructure Security Agency (CISA) updated an advisory on Iran-linked attackers targeting programmable logic controllers (PLCs) across critical infrastructure on July 22, four days before Minnesota said the attacks targeted its systems.
The advisory warned that Iran-linked hackers were attempting to disrupt operations using tactics previously associated with CyberAv3ngers. Government facilities, water and wastewater systems, and energy providers were among those urged to remain on high alert.
On July 26 and 27, more than 30 community water systems across Minnesota were disrupted by what officials called "a coordinated cyberattack" targeting operational technology (OT).
Minnesota IT Services (MNIT), the state's IT agency, said the Department of Health is working with the affected water facilities to ensure public health is maintained. No cities have yet asked citizens to modify the amount of drinking water they consume, per MNIT's latest update.
The agency did not offer many other details about the attacks, other than to mention all the different agencies, organizations, and bodies it is working with as part of the investigation.
One of the first cities to report issues, Braham, warned that its water reserves were limited in its initial notice. Citizens were asked not to water their lawns or use water for recreational purposes, although the problems were resolved the same day.
No such directives were issued in other affected cities. Maple Plain declared a state of emergency, allowing it greater flexibility to coordinate resources, but did not ask residents to adjust their consumption.
The same was true in the Twin Cities suburb of Plymouth and in South St. Paul, which both confirmed cyber-related problems on July 27 but did not ask residents to curb water use.
"Cyberattacks against critical infrastructure require a coordinated, whole-of-government response," said John Israel, MNIT assistant commissioner and Minnesota CISO.
"MNIT is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks.
"This incident demonstrates why Minnesota has invested in strong cybersecurity capabilities and partnerships. Our response worked as intended, enabling agencies at every level of government to rapidly coordinate, contain the incident, and help prevent more serious impacts to critical services."
First identified around 2020, CyberAv3ngers is widely believed to be linked to Iran's Islamic Revolutionary Guard Corps (IRGC), specifically its Cyber-Electronic Command division (IRGC-CEC).
For the first two years, the group began as a "propaganda persona," as Tenable puts it, claiming disruptive attacks on Israeli infrastructure – claims that were later debunked as fabrications.
Its first sustained campaign came in November 2023, when it compromised PLCs at the Municipal Water Authority of Aliquippa, Pennsylvania, defacing them anti-Israel messages.
Tenable said CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs across the United States, Israel, the United Kingdom, and Ireland as part of the campaign. They did so by exploiting default passwords.
Between 2024 and 2025, the crew developed the IOCONTROL malware kit, built for attacks on OT and Internet of Things (IoT) devices. OpenAI said in 2024 that the group's members used ChatGPT in the development process.
CyberAv3ngers stepped up its activity in 2026, targeting US critical infrastructure through Rockwell Automation/Allen-Bradley PLCs from March onward. CISA's July 22 update added Schneider Electric and Siemens equipment to the list of potential targets.
In some cases, the attacks - which targeted multiple critical infrastructure sectors - disrupted operations at affected facilities, federal officials said, though they offered no specifics on what those disruptions entailed.
CyberAv3ngers is known for targeting small water and municipal facilities, which experts believe are among the lowest-hanging fruit in US critical infrastructure.
Many small and rural facilities lack dedicated cybersecurity resources. Tenable said some operators manage OT environments using remote-access software such as TeamViewer and AnyDesk or leave their PLCs exposed to the web.
"These access methods bypass enterprise security controls entirely, creating an attack surface that is invisible to conventional security monitoring," Tenable said.
Poor segmentation between IT and OT environments can also allow a single intrusion to spread across much of the network.
(Score: 4, Touché) by Username on Tuesday August 04, @01:44PM (2 children)
>This incident demonstrates why Minnesota has invested in strong cybersecurity capabilities and partnerships
According to the article only Minnesota was effected by this stuxnet type attack. They should ask for their money back.
(Score: 4, Touché) by corey on Tuesday August 04, @11:50PM (1 child)
Connect critical infrastructure to the Internet, what could possibly go wrong?
(Score: 3, Touché) by driverless on Wednesday August 05, @05:09AM
Start a war of aggression against a technically advanced country and kill their school children when your own country is full of tech-based vulnerabilities, what could possibly go wrong?
(Score: 4, Interesting) by VLM on Tuesday August 04, @04:06PM (4 children)
Amazing how every time theres a big "cybercrime" people who clearly had no idea what they were doing the day before the attack are always experts at determining the source is 100% the bogeyman of the day, for "two minutes hate" purposes.
Yeah I'm sure these guys are totally legit and it was 100% Iranians LOL.
At least Pravda in the 1980s was at least somewhat tongue in cheek for the LOLs.
(Score: 2) by Username on Tuesday August 04, @05:03PM (2 children)
"CyberAv3ngers" is a dumb name at least. I really wish the feds would stop giving them cool names like Salt Typhoon. I'm not sure who gave them the name, but I'd name them SwineFeces or something similar.
(Score: 2) by VLM on Tuesday August 04, @05:42PM (1 child)
It's a profoundly bizarre name for a country that ranks VERY low on English proficiency. Sure, people "into computers", along with pilots, are unusually English proficient. But really?
It would be like reporting to gullible Iranians that we got together and named this site "سولنت نیوز ایز پپلز" I am told by a really stupid LLM/AI that's not the correct meaning but its a "sounds alike pronunciation" of SN's tagline. Like translating asking for a beer in spanish using english as "un sir visa pour faugh vore", or maybe worse. Who knows really, Fing LLMs. But someone in Iran would have to be really stupid to even consider we named our site in Persian all those years ago.
I tried looking up iranian and persian memes and aside from getting myself on yet another list (and hi to my FBI agent, sorry you have to read all this) I did not find anything I could remotely comprehend which is about what I'd expect from real Iranian hackers. Our bros shitposting on the equivalent of Persian 4chan /g/ are probably laughing at the dumb american journalists right now.
(Score: 0) by Anonymous Coward on Wednesday August 05, @03:24AM
Yeah it's "amazing" how accurate and good they are at figuring out the origin of the hackers except for the case where the FBI got hacked and the hacker allegedly deleted up to 100TB of data.
https://www.independent.co.uk/news/world/americas/us-politics/jeffrey-epstein-files-hacker-fbi-break-in-new-york-city-office-b2936381.html [independent.co.uk]
https://thenewamerican.com/us/tech/missing-epstein-files-2023-fbi-hack-wiped-100-terabytes-of-evidence/ [thenewamerican.com]
It's "funny" how many reports of the hack don't mention that lots of data got deleted...
How often do hackers delete data nowadays? I see lots more copying the data out and/or encrypting the stuff for a ransom.
If you copy out the blackmail stuff and delete it so that only you have copies, that can make your blackmailing more effective right?
(Score: 2) by epitaxial on Tuesday August 04, @06:20PM
The people who track these things have been sacked.
(Score: 3, Interesting) by VLM on Tuesday August 04, @06:07PM
This is a product completely unrelated to the story but its a great demonstration of how industry leaders are jealous of the "deploy first, test later" model of now trad CI/CD software development and generally moving the industry, its just the codesys is usually somewhat ahead of the competition AFAIK.
https://us.codesys.com/products/automation-server/features/ [codesys.com]
It's kind of the concepts of github plus dockerhub, but designed for PLC software. So you write your PLC code, possibly test it, then deploy to all your PLCs at once, possibly. Very handy if you have multiple identical process lines.
AFAIK from seeing this at a client site, this is a good product thats SSL'd to hell and back and well designed, etc. My only worry is if you have a centralized deployment system that's painting a huge target on it. You need access to one dev's terminal momentarily, then all hell can break loose.
I assure you this is very cool when its set up and working and my client was very happy. I was not directly involved but I never heard the people directly involved complain about it. But like I wrote, this is painting a big target on a SPOF.
This is much more "exciting" than merely having remote desktop access to a PLC IDE or leaving a PLC serial port on a terminal server on the internet. You upload your code to "github for PLCs" and your PLCs download and run the code automatically within minutes. Pretty cool, unless you upload bad code.
In theory, the PLC bros I hung out with were proud of the idea that their firmware and physical wiring was intrinsically safe against morons doing dumb things, both physically onsite and remote access, if you try to do something dumb the software will fight you and win, unless someone pulls the plug on the PLC (circuit breaker, whatever) and starts hotwiring things by hand. But in practice, there's always some weird situation they never considered that should be impossible but happens anyway, or a debug/maintenance mode that gets abused, and then it's all out the window.