US Intelligence Agencies Assess Iran Behind Coordinated Cyberattack on 36 Minnesota Water Systems as Fusion Center Report Links Activity to IRGC Cyber Command

Minnesota IT Services confirmed a coordinated cyberattack hit operational technology at 36 municipal water systems on Sunday and Monday, forcing towns including Braham, Plymouth and Maple Plain to isolate equipment and run pumps by hand 12. Braham restored manual control within about 90 minutes 12, and Maple Plain briefly declared a local emergency 2. Fox News reported that officials briefed on the investigation told the New York Times that tradecraft and the absence of a ransom demand led analysts to initially assess Iran was likely responsible, though the assessment could change 1. A Minnesota fusion center report obtained by journalist Andy Greenberg tied the intrusions to Iranian-affiliated hackers, and Tenable researchers separately flagged tactics resembling CyberAv3ngers, a group linked to Iran's IRGC Cyber-Electronic Command, though Minnesota IT Services said attribution remains unconfirmed and no evidence of drinking-water contamination has surfaced 12. Fox News reported that water and wastewater utilities in at least seven states have logged similar incidents since July 27, and the campaign extends beyond Minnesota 1. IBTimes UK reported the intrusions exploited an unpatched Rockwell Automation PLC flaw (CVE-2021-22681) that CISA had already flagged in an April advisory as a target of Iranian-affiliated actors, and that investigators considered but judged unlikely the possibility hackers were impersonating Iran to inflame tensions 2.