Iranian Threat Actors

Navy collage: a cut-out US map with three states marked and one red marker — water attacks confirmed across seven states, likely tied to Iran.

Critical Infrastructure

US Water Attacks Confirmed in Seven States — Michigan, Georgia, South Dakota Named; Trump Calls Minnesota Governor 'Grossly Incompetent'

The scope has names now. Water attacks span Minnesota plus at least six more states — Michigan, Georgia, and South Dakota confirmed — while Trump rejects the Iran assessment and calls Minnesota's governor 'grossly incompetent.' What's firm, what's political, and what operators should do.

Line illustration of a water-plant controller being disconnected from a public network, marked by a single red status dot.

Critical Infrastructure

CISA to Water Operators: Pull Exposed PLCs Off the Internet Now

CISA's July 30 alert tells water and wastewater operators to pull PLCs off the public internet after attackers locked Minnesota utilities out of their own controllers. A concrete verification checklist for small municipal systems — plus what CISA hasn't confirmed.

Flat white line-art of a folded memo document beside a water tower, on a deep teal background — the leaked memo tying the Minnesota water attacks to Iran.

Critical Infrastructure

Leaked Memo Confirms Iran Attribution for Minnesota Water Utility Attacks

From suspected attribution to a leaked internal memo — the Minnesota water attribution firms up this week.

Flat white line-art of a water tower linked to a control dial, on a teal background — the Minnesota water-system cyberattack.

Critical Infrastructure

30+ Minnesota Water Systems Hit in Coordinated Cyberattack — Iran-Linked CyberAv3ngers Suspected

Thirty water plants, one offline, one memo — the Minnesota attack scope lands this week.

Flat white line-art of an open back door linked by one line to a distant relay node, on a teal background — the NightLedger backdoor.

Nation-State Cyber Threats

Iran-Linked Nimbus Manticore Deploys NightLedger Backdoor Across Middle East, Africa, South Asia

New backdoor, familiar actor — the Iran-linked group tracked as Nimbus Manticore has a fresh toolset, and Kaspersky's write-up of NightLedger lands this week.

Flat white line-art of a water tower and an electricity pylon linked to an industrial controller box, on a deep amber background — CISA's advisory on Iran-linked targeting of ICS.

Iranian Threat Actors

CISA Warns Iran-Linked Actors Are Disrupting US Water and Energy Providers, Targeting Siemens and Schneider ICS

A CISA warning on Iran-linked disruption of US critical infrastructure — a defender review for water and energy operators this week.

US Water Attacks Confirmed in Seven States — Michigan, Georgia, South Dakota Named; Trump Calls Minnesota Governor 'Grossly Incompetent'

CISA to Water Operators: Pull Exposed PLCs Off the Internet Now

Leaked Memo Confirms Iran Attribution for Minnesota Water Utility Attacks

30+ Minnesota Water Systems Hit in Coordinated Cyberattack — Iran-Linked CyberAv3ngers Suspected

Iran-Linked Nimbus Manticore Deploys NightLedger Backdoor Across Middle East, Africa, South Asia

CISA Warns Iran-Linked Actors Are Disrupting US Water and Energy Providers, Targeting Siemens and Schneider ICS

Recorded Future: Iran's MOIS Has Expanded Its Handala Brand From Hacking Into Recruiting Proxies for Physical Attacks

Gambit Security Ties LA Metro Hacktivist Persona 'Ababil of Minab' to Iran's MOIS

Nimbus Manticore Returns With MiniFast, an AI-Assisted Backdoor Hitting Aviation and Aerospace

Iran-Nexus APT Screening Serpens Hijacks .NET Apps to Disable Their Own Defenses

Iran-Linked Handala Leaks 2,379 US Marines' Data and Sends Chilling WhatsApp Threats

U.S. Agencies Warn of Sustained Iranian Campaign Targeting Critical Infrastructure