Loading...
Loading...
Iran's Islamic Revolutionary Guard Corps (IRGC) has conducted a sustained campaign against American water systems and critical infrastructure, disguising state operations as hacktivist activity.
June 2025 Warning: Following US strikes on Iranian nuclear facilities, NSA, CISA, FBI, and DC3 issued joint advisory warning of increased Iranian cyber threat activity against critical infrastructure.
IRGC-CEC's campaign against American water utilities
State Actors, Not Hacktivists: The "CyberAv3ngers" initially claimed to be ideologically motivated hacktivists. Within a month, the US Treasury sanctioned IRGC officials for directing the operation. They were state actors all along.
First confirmed water utility breach (Pennsylvania)
Multiple waves targeting Unitronics PLCs nationwide
CISA issues emergency advisory AA23-335a
At least 75 devices confirmed compromised
Treasury sanctions 6 IRGC-CEC officials
CISA updates advisory with new TTPs
Perpetrator: CyberAv3ngers (IRGC-CEC)
75+ Unitronics PLCs compromised; 34 water utilities affected
Response: Treasury sanctioned 6 IRGC-CEC officials in February 2024
Perpetrator: CyberAv3ngers (IRGC-CEC)
Water pressure monitoring system compromised
Response: FBI and CISA issued joint advisory
Perpetrator: Homeland Justice (IRGC-linked)
Government systems wiped; services disrupted for weeks
Response: US imposed sanctions on Iranian intelligence ministry
If you operate water systems, energy infrastructure, or any OT/ICS environment, take immediate steps to secure your systems.