Adversary Intelligence — 2026-07-30

IRGC-Linked CyberAv3ngers Suspected in Coordinated Attack on 30+ Minnesota Water Systems

BLUFFormal U.S. attribution of the Minnesota water intrusions to CyberAv3ngers is unlikely within 90 days, but the expanded PLC exploitation pattern demands immediate vendor-agnostic hardening across small municipal utilities.

A coordinated cyberattack disrupted water and wastewater operations across more than 30 Minnesota communities on July 26 and 27, with Braham, Plymouth, South St. Paul, and Maple Plain disclosing effects 12. Braham's well and treatment plant went offline before crews restored it within about two hours, Plymouth disconnected cellular-linked equipment at two water towers and several lift stations, and Maple Plain declared a local emergency 1. Minnesota IT Services activated a statewide cybersecurity response, and officials said drinking water quality remained unaffected with no boil-water advisories issued. Federal and state officials have not attributed the attack, but Tenable Research said the pattern matches the IRGC-linked CyberAv3ngers group, noting the timing follows a July 22 CISA advisory update expanding documented Iranian-affiliated PLC exploitation to Schneider Electric and Siemens devices, and assessing the likely entry point as CVE-2021-22681, an unpatched authentication-bypass flaw rated CVSS 9.8 in Rockwell Automation Logix controllers reachable through internet-exposed, misconfigured PLCs via vendor engineering software 1.

Analysis
Federal attribution to CyberAv3ngers is unlikely within 90 days, since CISA and the FBI typically withhold formal naming until forensic access across dozens of independently governed municipal networks is complete. Moderate confidence reflects reliance on a single technical source, Tenable Research, tying the intrusion pattern to CVE-2021-22681 exploitation, without independent government confirmation; Minnesota IT Services' incident advisory and secondary Hacker News amplification round out sourcing. The July 22 CISA advisory expansion to Schneider Electric and Siemens PLCs, beyond Rockwell alone, shows the exploitation campaign has outgrown vendor-specific defenses, and Plymouth's cellular-linked field equipment illustrates how smaller utilities stay exposed regardless of attribution timing. The pattern could equally reflect opportunistic exploitation of the same public vulnerabilities by unrelated criminal or hacktivist actors rather than a coordinated IRGC-directed operation. Formal attribution would trigger sanctions or diplomatic action against Iran, while continued non-attribution leaves utilities funding defenses against an unnamed but active threat.

3 sources

Coordinated cyberattack on Minnesota water utilities: What you need to know - Tenable
Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline - The Hacker News
MNIT activates statewide cybersecurity response to support affected communities and protect critical infrastructure - Minnesota IT Services (MNIT)