Iranian hackers behind cyberattack on Minnesota water systems? What we know

A series of cyberattacks targeting local water systems in the US state of Minnesota has raised concerns over a possible Iran-linked hacking operation, according to US media reports. Around 30 water systems were targeted in attacks carried out on Sunday (Jul 26) and Monday (Jul 27), with investigators examining links to the CyberAv3ngers group, a cybercriminal group that US officials have previously accused of being backed by Tehran.

The attack temporarily disrupted water services in Braham, a small town in the Minneapolis metropolitan area. Officials restored operations after the disruption lasted for nearly two hours, according to reports.

Cybersecurity firm Tenable said the techniques used in the incident showed similarities with methods associated with CyberAv3ngers. The group has previously targeted industrial control systems, including critical infrastructure networks.

While US investigators suspect Iranian involvement, authorities have not yet officially attributed the attack to Tehran. The FBI has not publicly commented on the incident.

The cyberattack comes days after the US Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about potential threats from Iran-aligned groups targeting internet-connected control systems used in critical infrastructure across the country.

The warning highlighted the growing risk of cyber operations aimed at disrupting essential services, including water, energy and other public utilities.

CyberAv3ngers has been linked by US officials to Iran’s Islamic Revolutionary Guard Corps (IRGC), although Tehran has repeatedly denied allegations of directing cyberattacks against foreign targets.

The latest incident adds to a growing list of cyber operations blamed on Iranian-linked groups. In March, the Handala Hack group claimed responsibility for attacks targeting US medical equipment manufacturer Stryker and digital payments company Verifone.

Stryker confirmed it had faced a cyber incident, while Verifone rejected claims that it had been targeted.

The Handala group said its actions were retaliation for a February strike on an elementary school in Minab, southern Iran, during the US-Israeli offensive against Iran. A US military investigation later found that the strike may have occurred due to incorrect coordinates used while targeting a nearby military facility.

The Minnesota attacks have renewed concerns over the vulnerability of US infrastructure to politically motivated cyber campaigns.