A notorious Iran-linked hacker group, known as the "Cyberav3ngers," is suspected of carrying out recent cyberattacks that disrupted water systems across at least seven U.S. states, according to cybersecurity firm Tenable. The group, which has declared ties to Iran's Islamic Revolutionary Guard Corps (IRGC), has been under scrutiny since war broke out between Iran and its adversaries.
Experts observed the Cyberav3ngers posting on the dark web about plans to target North American water infrastructure in the weeks following the start of hostilities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also issued a warning on July 22, indicating that the Cyberav3ngers, and by extension Iran, were likely targeting U.S. systems.
These attacks reportedly involved gaining control of internet-connected water control systems, with over 30 affected in Michigan alone. Hackers allegedly locked out administrators and disrupted the pumping of water into systems, including water towers. While no significant long-term disruptions or harm resulted, and order was quickly restored at affected sites, the lack of immediate credit claimed by the attackers has led experts to caution that the assault may not be over.
Chris Day, Chief Technology Officer for Tenable Public Sector, noted that the Cyberav3ngers are usually vocal after operations. "In the past we’ve seen them when they started making claims it’s usually after the operation, so that makes me wonder, this operation may not be over," Day stated. He added that the group might be waiting to extract maximum gain and notoriety before announcing their involvement.
Law enforcement sources indicated that the hackers could have potentially accessed systems controlling the dosage of chemicals in water supplies, a capability that could have had severe consequences. Although concrete proof directly linking the Cyberav3ngers to the recent attacks or confirming them as IRGC proxies remains elusive, Day pointed to the attacks bearing the hallmarks of the group's and Iran's known cyberwarfare tactics. "They’ve always been kind of opportunistic, looking for exposed systems where they can leverage a known vulnerability," he said, describing the Cyberav3ngers as a "mid-tier" threat.
The Cyberav3ngers have been active since at least 2020, primarily targeting infrastructure within Iran's regional adversaries. However, they have previously targeted U.S. water systems, with incidents reported in Pennsylvania between October 2023 and January 2024.
Despite the U.S. authorities' ability to mitigate the impact of these recent attacks, experts like Day emphasize that such incidents highlight existing cybersecurity vulnerabilities in critical U.S. infrastructure. The potential consequences of a more severe attack could include widespread blackouts and water stoppages.
Following the cybersecurity assessments, former President Donald Trump publicly denied Iranian involvement in the attacks, instead attributing the issues to the "corrupt" and "grossly incompetent" leadership of Minnesota Governor Tim Walz. Governor Walz responded by accusing the former president of deflecting, stating on X that Trump was aware of the responsible parties and the broader scope of the attacks across multiple states, framing it as an example of modern warfare tactics without a clear strategy for engagement with Iran.