Industrial Control Systems (ICS)
CISA has confirmed that more than 100 internet-exposed US water systems were targeted in July 2026, activity widely suspected to be Iran-linked. One expert calls it a test run for something larger. Here is what defenders should verify, and what is still unconfirmed.
Industrial Control Systems (ICS)
CISA's red team got initial access to both a water utility and a government organization using nearly identical tradecraft. The water sector isolated and shut it down in minutes. The government sector never detected it. Detection and isolation, not prevention, decided the outcome.
Industrial Control Systems (ICS)
A suspected Iran-linked cyberattack kept a small UK power plant offline for four days in July 2026, the same month more than 30 US water utilities were hit. The government says the wider grid was never at risk. Here is what defenders should verify.
Industrial Control Systems (ICS)
New Nozomi Networks research, unveiled at Black Hat, shows how unprotected TSN (Time-Sensitive Networking) protocols could let attackers disrupt or manipulate physical processes in OT networks. It is lab research, not an active campaign, and segmentation is the first defense.
Industrial Control Systems (ICS)
Five US agencies, led by NSA, FBI and CISA, warn that an active campaign is using AI-assisted development to build tools targeting internet-exposed Siemens S7 Series PLCs, in what may be the first US-agency flag of AI-assisted tradecraft against OT.
Ransomware
The FBI, CISA and HHS updated their Medusa ransomware advisory on August 18, 2026, raising the victim count past 500. Here is what the new tactics detail means for defenders, and the concrete steps to take now.
Critical Infrastructure
Over roughly two weeks, hackers broke into systems at several US water plants, in attacks TechCrunch reports were allegedly carried out by the Iranian government. This synthesis separates what is confirmed about the campaign from what remains contested, including the attribution fight.
Artificial Intelligence (AI)
A follow-on to Dream's Taiwan disclosure: The Register reports the government target hit by the near-autonomous agentic swarm was the country's nuclear safety agency, the highest-stakes autonomous-agent target on record, even though the attack's success stays unconfirmed.
Ransomware
A joint U.S.-South Korea advisory ties the Gunra ransomware-as-a-service crew to a repeatable break-in: two unpatched Fortinet authentication-bypass flaws, defeated MFA, and an encryptor built from leaked Conti code. The fixes have been available since early 2025.
Critical Infrastructure
A Forescout scan counted more than 4,400 internet-exposed Rockwell PLCs worldwide — and 22 of them sit in the exact cities where water utilities were attacked. Here is what the numbers show, what defenders can verify today, and what is still unconfirmed.
Critical Infrastructure
The water campaign keeps growing. Cyberattacks have reportedly hit at least 12 US states, per SecurityWeek — and Georgia's Clayton County confirmed a pump-station disruption, the latest named operational impact in a campaign that began with 30-plus Minnesota systems.
Critical Infrastructure
The scope has names now. Water attacks span Minnesota plus at least six more states — Michigan, Georgia, and South Dakota confirmed — while Trump rejects the Iran assessment and calls Minnesota's governor 'grossly incompetent.' What's firm, what's political, and what operators should do.