Adversary Intelligence — 2026-05-21

Cipher Brief Analysis Documents IRGC Cyber Campaign Against US Critical Infrastructure Following February Strikes

BLUFAdditional public attribution of IRGC-affiliated disruptive attacks on US critical infrastructure is likely by August 19, 2026, even as CISA's gutted staffing threatens to delay the warning pipeline.

The Cipher Brief reports that since U.S. and Israeli strikes on February 28, IRGC-affiliated hackers moved beyond reconnaissance into confirmed disruptive attacks on U.S. soil 1. On March 11, Handala, assessed as a front for Void Manticore, wiped roughly 80,000 Windows devices at Stryker, stole 50 terabytes of data, and severed Maryland EMS electrocardiogram relay access; the FBI subsequently seized two Handala data-leak domains 1. A CISA advisory issued April 7, cited by the Cipher Brief, confirmed that CyberAv3ngers, an IRGC-affiliated group, was actively exploiting programmable logic controllers across U.S. water, wastewater, energy, and government facilities 1. FDD on May 20 reported that Iran-linked hackers breached fuel tank gauge systems at gas stations in multiple states, exploiting absent or default passwords to manipulate display data 2.

Analysis
CISA, FBI, or NSA will likely issue at least one additional public attribution of IRGC-affiliated disruptive attacks on U.S. critical infrastructure by August 19, 2026. High confidence rests on a multi-sector evidentiary record anchored by CISA's April PLC advisory and corroborated by Cipher Brief and FDD analysis across non-overlapping source networks. A concurrent German prosecution of IRGC Quds Force agents for plotting assassinations of Jewish leaders confirms Tehran is running parallel kinetic and cyber campaigns against Western targets. CISA's one-third staffing reduction and $600 million budget cut create a lag risk in attribution against an accelerating threat tempo. The campaign may instead reflect opportunistic exploitation of soft targets, with IRGC-affiliated groups optimizing for psychological effect over strategic coherence. Congressional appropriators weighing CISA funding restoration and water and healthcare operators holding unpatched PLCs cannot price that possibility favorably.

3 sources

Irans Digital War Machine Targeting U.S. Infrastructure - The Cipher Brief
U.S. Needs To Upgrade Critical Infrastructure To Counter Iranian Hackers - Foundation for Defense of Democracies
Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure - CISA (Cybersecurity and Infrastructure Security Agency)