Iran Shadow Looms Over Minnesota Water Cyberattacks

More than 30 municipal water and wastewater systems in Minnesota were targeted in cyber intrusions, and a leaked industry memo now ties the campaign to Iran-affiliated hackers.

That makes the Minnesota water cyberattacks more than a state-level utility scare. The deeper signal is sharper: foreign-linked operators are probing basic civilian services where even limited disruption can force emergency procedures, public reassurance, and federal warnings. The memo, obtained by Wired, links the Minnesota incidents to a prior campaign described by CISA as carried out by “Iran-affiliated” hackers.

Water is a uniquely sensitive target. A breach doesn’t need to poison a supply or shut down a city to create pressure. If automated controls fail, if plant staff must switch to manual operations, or if residents hear “boil-water notice,” trust takes the hit before the technical picture is complete.

The leaked WaterISAC memo turns Minnesota water cyberattacks into a national warning

The memo was sent to members of the Water Information Sharing and Analysis Center, or WaterISAC, an industry group that shares security information with water utilities. According to Wired, the WaterISAC communication referenced a Minnesota Fusion Center alert about “ongoing malicious cyber activity impacting public drinking water systems across Minnesota.”

The key phrase is attribution-adjacent, not courtroom proof. The memo said the Minnesota Fusion Center found the activity was “aligned” with a campaign CISA first described in April as involving Iran-affiliated hackers.

That distinction matters. Cyber attribution often rests on patterns: targeted equipment, tactics, infrastructure, timing, and overlap with known campaigns. The WaterISAC memo appears to connect the Minnesota attacks to an existing federal warning, but WaterISAC later pushed back on the idea that it made its own attribution call.

Jennifer Lyn Walker, WaterISAC’s director of infrastructure cyber defense, told Wired the organization had not provided the leaked memo and did not “assess attribution at any time.”

For readers tracking the incident sequence, XOOMAR’s related coverage of 30 Minnesota Water Systems Rattled by Cyberattacks gives the operational context behind the state’s disclosures.

PLCs are the pressure point in the Minnesota campaign

The technical center of the case is the programmable logic controller, or PLC, the industrial device used to automate and coordinate equipment inside critical infrastructure.

The WaterISAC memo said the attackers compromised remotely accessible PLCs, matching the earlier CISA-described campaign. It also said the “likely desired impact” was to cause loss of system pressure and potential contamination of the water supply. The facilities “were able to mitigate further compromise, but the full impact is still being assessed,” according to the memo cited by Wired.

CISA’s newer advisory warned that “these threat actors are targeting water entities of all sizes” and urged utilities to disconnect PLCs from the internet, use strong password protection, and “allow-list” only trusted devices.

That advice is basic, but the fact CISA had to repeat it in this context is the point. If internet-reachable industrial controls remain exposed, attackers don’t need a cinematic cyber weapon. They need access, weak controls, and enough understanding to disrupt operations.

For the technical warning behind that risk, see XOOMAR’s related analysis of Exposed PLCs Trigger CISA Water Systems Attack Alarm.

Braham shows how limited disruption can still force a crisis posture

Minnesota officials said more than 30 municipal water and wastewater systems were targeted. In some cases, intrusions disabled telecommunications between industrial control systems and water utility equipment.

The clearest local disruption reported so far was in Braham, a city of 1,700 people, where hacking reportedly caused a brief outage at the city’s water plant. Wired reports there is not yet evidence of water shortages or a threat to Minnesota’s water supply.

CISA’s advisory, however, said the attacks have “resulted in boil-water notices” and “sustained manual operations.” That’s a serious operational consequence even without confirmed contamination.

“Now we have documented disruption and even modification of safety and protection parameters in critical infrastructure,” Joe Slowik told Wired. “Seeing this sort of tradecraft expand to Iran, and seeing it across multiple sites, it should really be making people concerned right now.”

XOOMAR analysis: The strategic value here is not mass destruction. It is forced uncertainty. When a utility has to prove that water remains safe after attackers reached control systems, the attacker has already created a public-management problem.

CyberAv3ngers, Handala, and the attribution gap

Two Iran-linked names sit around the Minnesota case, but neither has been publicly confirmed as the operator.

Tenable said signs suggested CyberAv3ngers, an Iranian hacker group tied to the Islamic Revolutionary Guard Corps, may be responsible. The firm wrote that “the operational pattern is consistent with” CyberAv3ngers or related groups.

Separately, Claroty researcher Yhonatan Harari told Wired there was evidence the attacks might have been carried out by Handala, another group that claimed responsibility for the Stryker attack in March and the compromise of FBI director Kash Patel’s personal email later that month.

Harari’s assessment was blunt: “We’re not sure yet if it’s CyberAv3ngers or Handala,” he said, “but in a very high likelihood we can say it’s Iranian actors.”

That is the current attribution line: strong suspicion around Iranian actors, unresolved group identity, and no public Iranian hacker claim cited in the reporting.

Iran’s earlier water-system playbook matters because Minnesota fits the pattern

CyberAv3ngers first drew attention in late 2023 after targeting Unitronics industrial control devices, which are commonly used in water and wastewater facilities. Those attacks set devices to display “Gaza” and the CyberAv3ngers logo.

At first glance, that looked like vandalism. Cybersecurity firms including Dragos and Claroty told Wired the hackers had rewritten device code, causing disruption of water-related services from Israel to Ireland to a facility in Pittsburgh, Pennsylvania.

Since then, according to Wired, CyberAv3ngers activity continued despite a $10 million State Department bounty and Treasury sanctions against six IRGC officials alleged to be linked to the group. Dragos said the group later breached a US oil and gas company in 2024 and carried out a broader campaign infecting industrial control and internet-of-things devices with malware known as IOControl.

XOOMAR analysis: Minnesota matters because it suggests the same operational theme may be moving from display defacement and limited disruption toward broader pressure on municipal infrastructure. The target is water. The access path is exposed control technology. The payoff is public anxiety.

Utilities, agencies, and residents will read the same memo differently

Utility operators will see a practical problem first: exposed equipment, remote access, passwords, manual fallback, and incident response. The reporting does not quantify staffing or budgets, so claims about underfunding should stay cautious. But the technical burden is clear from CISA’s own mitigation list.

Federal agencies will read the memo as another warning that water systems remain reachable by foreign-linked actors. The advisory was issued with agencies including the FBI, NSA, Cyber Command, EPA, and Department of Energy, which shows the concern is not confined to one regulator.

State and local officials face the hardest communications task. Minnesota officials said all drinking water remained safe. South St. Paul officials said contingency procedures allowed staff to maintain normal water and wastewater operations after automated controls were affected.

Residents care about one question: is the water safe? If officials answer too slowly or too vaguely, communications become the second failure.

The next water cyber story may be many small intrusions, not one spectacular hack

The most important line from Slowik may be his warning that the activity does not have to stop in Minnesota.

“There are plenty of other sites that have the same targeted technology,” he told Wired. “There’s plenty of areas for this to still be executed by an adversary that has shown a willingness to do so.”

That is the watch item. If more utilities report PLC compromise, manual operations, boil-water notices, or similar operational disruption, the thesis hardens: Iran-linked actors are treating local water infrastructure as a repeatable pressure point.

If, instead, investigations show narrow access, limited overlap with the earlier CISA campaign, or no further spread beyond Minnesota, the attribution and escalation story weakens.

For now, voluntary guidance looks too thin for the threat described. The water sector needs money, mandates, and technical help in the same package. Otherwise the next major Minnesota water cyberattacks story may not be a dramatic takedown. It may be the accumulation of small intrusions that finally forces the US to treat local utility security as national security infrastructure.

Impact Analysis

• Foreign-linked cyber activity against water systems raises concerns about the security of basic civilian infrastructure.
• Even limited disruptions can force manual operations, emergency notices, and public reassurance from local officials.
• The leaked memo suggests Minnesota incidents may fit a broader federal warning about Iran-affiliated hacking campaigns.