A well-known hacker collective with suspected ties to Iran is believed to be behind a recent wave of cyberattacks on water systems across the United States — and cybersecurity specialists warn the campaign may not be over.
The group calling itself “Cyberav3ngers” appears to have carried out the intrusions, which affected water infrastructure in seven states over the past several months, according to cybersecurity firm Tenable. The company told The Post that the group began discussing plans on the dark web to target the US within weeks of the war with Iran breaking out.
“We listened or observed them kind of declaring that they were going to start targeting US Water infrastructure in in North America,” Tenable Public Sector Chief Technology Officer Chris Day said. “We started tracking activity back in April, right around the beginning of the Iran War.”
Cyberav3ngers has repeatedly portrayed itself as closely aligned with Iran’s Islamic Revolutionary Guard Corps, or IRGC. The US Cybersecurity and Infrastructure Security Agency, known as CISA, also issued a July 22 warning that the group — and, by extension, Iran — was likely focusing on American systems.
The cyberattacks led to dozens of internet-connected water control systems being compromised, including more than 30 in Michigan alone. In some cases, hackers locked out administrators and stopped water from being pumped into critical infrastructure such as water towers.
Officials have reported no major disruptions or injuries, and normal operations were quickly restored at each affected site. Still, no one has publicly claimed responsibility for the attacks, a silence that has raised concern among experts who say the operation could still be active — particularly because Cyberav3ngers appears to fit the pattern.
“Usually they’re pretty vocal,” Day said. “But in the past we’ve seen them when they started making claims it’s usually after the operation, so that makes me wonder, this operation may not be over.”
“Or they’re still wanting to try to extract maximum gain and notoriety out of it before they say anything,” he added.
And the attacks had the potential to be worse — with law enforcement sources telling The Post hackers could have gained access to systems which control and monitor the dosage of possibly dangerous chemicals in local water supplies.
There remains no concrete proof that the Cyberav3ngers were actually behind the attacks or are even IRGC proxies, but Day said the attacks bore all the fingerprints of both the group’s and Iran’s known tactics in cyberwarfare.
“They’ve always been kind of opportunistic, looking for exposed systems where they can leverage a known vulnerability,” Day said, calling the Cyberav3ngers a “mid-tier” threat-level.
“And they’re always acting as a proxy for the [Iranian] regime in some way,” he added.
The group has been around since at least 2020, and typically targets infrastructure systems within Iran’s enemies in the Middle East.
But the Cyberav3ngers hackers have previously targeted the US, with water systems being hit in Pennsylvania during a spate of attacks from Oct. 2023 to Jan. 2024, according to Tenable.
And while the US was able to easily mop up the effects of the latest attacks, Day cautioned that actions from the likes of the Cyberav3ngers expose cybersecurity vulnerabilities in US infrastructure — which at its worst could result in widespread blackouts and water stoppage.
“We’ve seen no indication that it’s going to get worse, we don’t expect to see a major escalation,” Day said. “But you have to be vigilant.”
Despite CISA and Tenable fingering the Cyberav3ngers as the likely culprit, the situation was cast into confusion Friday after President Trump denied any Iranian involvement — and instead blamed Minnesota’s “corrupt” Gov. Tim Walz.
“They blame it on Iran. I don’t think so,” Trump said. “I think I blame it on Minnesota, because they’re grossly incompetent.”
Walz then accused the president of deflecting.
“Trump knows exactly who is responsible for this attack, and knows that other states were hit too,” Walz wrote on X. “This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.”
