Loading story…
Iran-linked hackers reportedly targeted 100 U.S. water utilities amid heightened U.S.-Iran military tensions. Broader activity has also sought access to internet-exposed water, energy, and telecommunications systems, with attackers appearing to focus on reachable operational environments and other remotely accessible infrastructure.
There is no public evidence that the activity caused major disruption or achieved a strategic cyberattack, but the attempted access and reconnaissance could enable future operations and signal coercive intent. The EPA is providing $11 million to strengthen water-sector cybersecurity; infrastructure operators should restrict remote access, rotate credentials, segment operational technology, improve logging, and test incident-response plans.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
The U.S. State Department offered a $10 million reward for information on Amir Yaryab, alleging he leads the IRGC Cyber-Electronic Command and oversees or directs CyberAv3ngers, Dadeh Afzar Arman, Mehrsam Andisheh Saz Nik, Shahid Hemmat, and Shahid Shushtari. Officials said these groups have targeted civilian and critical-infrastructure sectors across the United States, Europe, and the Middle East.
The U.S. Environmental Protection Agency is providing $11 million to improve cybersecurity for water systems.
Bloomberg reported that Iran-linked hackers hit 100 American water utilities; the available material does not identify the actor, affected utilities, methods, timing, or operational impact. Separate reporting characterized Iranian-linked activity during heightened U.S.-Iran confrontation as attempted access to accessible internet-connected water, energy, and telecommunications systems, with no public evidence of major disruption.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecybercenter.space
Open sourcebloomberg.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A small UK power plant was reportedly forced offline for four days after an intrusion attributed to Iran-linked hackers, marking what has been described as the first confirmed cyber-induced shutdown of a British power facility. The outage did not affect the broader electricity grid, but the incident was reported to the UK's National Cyber Security Centre and prompted warnings to energy operators about heightened risks to critical infrastructure. The activity coincided with a broader wave of suspected Iranian operations targeting water and wastewater systems in the United States, where officials linked attacks across 12 states to flooding, pressure loss, and boil-water advisories. In New Jersey, Hamilton Township Municipal Utilities Authority disclosed a cyber threat and said the extent of unauthorized access remained unclear, adding to concerns that water utilities are among the sectors facing sustained hostile probing and disruption.
Aug 28, 2026
Water and wastewater utilities across at least seven U.S. states reported cyberattacks targeting industrial control systems, with Minnesota, Michigan, and Georgia among the states disclosing incidents and Minnesota saying more than 30 community water systems were hit during July 26-27. Officials said some utilities switched to manual operations, and the FBI warned that some activity degraded water operations, although states reporting publicly said impacts were limited and drinking water safety was not significantly disrupted. The attacks reportedly focused on older internet-connected operational technology, particularly **Rockwell Automation/Allen-Bradley PLCs**, while government guidance also warned that **Schneider Electric**, **Siemens**, and other PLC brands could be at risk. U.S. officials have not publicly attributed the campaign, but federal concern has centered on possible Iranian state-linked activity because the intrusions appeared disruptive rather than financially motivated. Reporting and prior threat intelligence have linked the activity to **CyberAv3ngers**, an IRGC-associated group previously tied to disruptive operations against water, manufacturing, and energy infrastructure, including the Municipal Water Authority of Aliquippa in Pennsylvania and water services in County Mayo, Ireland. OpenAI said it had earlier banned accounts assessed to belong to CyberAv3ngers after observing use of its models for reconnaissance, vulnerability research, code debugging, scripting help, and post-compromise tradecraft involving industrial control systems and PLC-related targets.
Aug 24, 2026
Hackers associated with China have gained unauthorized access to the IT networks of hundreds of small and medium-sized water utilities and other critical infrastructure providers across the United States. These intrusions are believed to be part of a broader strategy to position Chinese actors to sabotage American water and power supplies in the event of a geopolitical conflict, particularly if tensions escalate over Taiwan. U.S. officials have been aware of this threat for over two years, and recent reporting has brought renewed attention to the scale and persistence of these cyber operations. The targeted utilities are often located in rural areas and small towns, which typically lack the cybersecurity resources and expertise of larger metropolitan systems. The operational technology (OT) systems that control water treatment and distribution are especially vulnerable due to their increasing automation and remote accessibility. The risk is compounded by a significant resource gap, as many of these utilities struggle to defend against sophisticated nation-state threats. Efforts to bolster defenses have included the launch of two non-profit initiatives aimed at supporting critical infrastructure operators, but these programs face their own limitations. One of the non-profits has paused its activities to recalibrate its approach, while the other is only able to provide assistance in a limited number of states due to resource constraints. The threat underscores the broader challenge of protecting critical infrastructure in the United States, where many essential services are managed by small organizations with limited budgets. The potential for cyber sabotage of water and power systems raises concerns about the resilience of civilian infrastructure in the face of international conflict. U.S. government agencies have issued warnings and guidance to utilities, but implementation of robust security measures remains inconsistent. The situation highlights the need for increased investment in cybersecurity for critical infrastructure, particularly in rural and underserved areas. The ongoing threat from Chinese-linked hackers demonstrates the strategic importance of water and power utilities as potential targets in modern cyber warfare. The exposure of these vulnerabilities has prompted calls for greater public-private collaboration and federal support. The risk is not limited to water utilities, as other sectors of critical infrastructure may face similar threats from state-sponsored actors. The revelations serve as a wake-up call for the urgent need to address cybersecurity gaps in essential services. The possibility of coordinated attacks on infrastructure during a geopolitical crisis could have far-reaching consequences for national security and public safety. The current state of preparedness among small utilities is insufficient to counter the scale and sophistication of the threat. The situation remains dynamic, with ongoing efforts to assess and mitigate the risks posed by foreign cyber actors.
Jul 12, 2026