Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems

Security

More than 30 facilities disrupted in ‘coordinated cyberattack,’ though officials have yet to name a culprit

Security researchers at Tenable suspect the Iran-linked faux hacktivist outfit CyberAv3ngers was behind the cyberattack that disrupted more than 30 Minnesota water facilities.

Neither state-level nor federal officials have made any claims regarding attribution for the attacks, however, Tenable reckons the operational pattern is consistent with the crew’s previous raids, noting the timing relative to recent government warnings.

The Cybersecurity and Infrastructure Security Agency (CISA) updated an advisory on Iran-linked attackers targeting programmable logic controllers (PLCs) across critical infrastructure on July 22, four days before Minnesota said the attacks targeted its systems.

The advisory warned that Iran-linked hackers were attempting to disrupt operations using tactics previously associated with CyberAv3ngers. Government facilities, water and wastewater systems, and energy providers were among those urged to remain on high alert.

What happened in Minnesota?

On July 26 and 27, more than 30 community water systems across Minnesota were disrupted by what officials called “a coordinated cyberattack” targeting operational technology (OT).

Minnesota IT Services (MNIT), the state’s IT agency, said the Department of Health is working with the affected water facilities to ensure public health is maintained. No cities have yet asked citizens to modify the amount of drinking water they consume, per MNIT’s latest update.

The agency did not offer many other details about the attacks, other than to mention all the different agencies, organizations, and bodies it is working with as part of the investigation.

One of the first cities to report issues, Braham, warned that its water reserves were limited in its initial notice. Citizens were asked not to water their lawns or use water for recreational purposes, although the problems were resolved the same day. 

No such directives were issued in other affected cities. Maple Plain declared a state of emergency, allowing it greater flexibility to coordinate resources, but did not ask residents to adjust their consumption. 

The same was true in the Twin Cities suburb of Plymouth and in South St. Paul, which both confirmed cyber-related problems on July 27 but did not ask residents to curb water use.

“Cyberattacks against critical infrastructure require a coordinated, whole-of-government response,” said John Israel, MNIT assistant commissioner and Minnesota CISO.

“MNIT is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks. 

“This incident demonstrates why Minnesota has invested in strong cybersecurity capabilities and partnerships. Our response worked as intended, enabling agencies at every level of government to rapidly coordinate, contain the incident, and help prevent more serious impacts to critical services.”

What is CyberAv3ngers?

First identified around 2020, CyberAv3ngers is widely believed to be linked to Iran’s Islamic Revolutionary Guard Corps (IRGC), specifically its Cyber-Electronic Command division (IRGC-CEC).

For the first two years, the group began as a “propaganda persona,” as Tenable puts it, claiming disruptive attacks on Israeli infrastructure – claims that were later debunked as fabrications.

Its first sustained campaign came in November 2023, when it compromised PLCs at the Municipal Water Authority of Aliquippa, Pennsylvania, defacing them anti-Israel messages.

Tenable said CyberAv3ngers compromised at least 75 Unitronics Vision Series PLCs across the United States, Israel, the United Kingdom, and Ireland as part of the campaign. They did so by exploiting default passwords.

Between 2024 and 2025, the crew developed the IOCONTROL malware kit, built for attacks on OT and Internet of Things (IoT) devices. OpenAI said in 2024 that the group’s members used ChatGPT in the development process.

CyberAv3ngers stepped up its activity in 2026, targeting US critical infrastructure through Rockwell Automation/Allen-Bradley PLCs from March onward. CISA’s July 22 update added Schneider Electric and Siemens equipment to the list of potential targets.

In some cases, the attacks – which targeted multiple critical infrastructure sectors – disrupted operations at affected facilities, federal officials said, though they offered no specifics on what those disruptions entailed.

CyberAv3ngers is known for targeting small water and municipal facilities, which experts believe are among the lowest-hanging fruit in US critical infrastructure.

Many small and rural facilities lack dedicated cybersecurity resources. Tenable said some operators manage OT environments using remote-access software such as TeamViewer and AnyDesk or leave their PLCs exposed to the web.

“These access methods bypass enterprise security controls entirely, creating an attack surface that is invisible to conventional security monitoring,” Tenable said.

Poor segmentation between IT and OT environments can also allow a single intrusion to spread across much of the network. ®