A series of cyber assaults targeting numerous water systems across the United States is believed to have been orchestrated by a well-known hacker group with ties to Iran. Experts caution that this malevolent entity might not yet have concluded its operations.
Known as the “Cyberav3ngers,” this group is suspected of orchestrating recent cyber-attacks that have affected seven states. According to Tenable, a cybersecurity firm, the hackers began hinting at their intentions to strike the US on dark web forums shortly after conflict erupted between the US and Iran. The firm shared these findings with The Post, emphasizing the group’s subversive actions.
Chris Day, Tenable’s Public Sector Chief Technology Officer, explained, “We detected them either declaring or signaling that they intended to set their sights on North America’s water infrastructure.” He added that the group’s activities attracted attention as far back as April, aligning with the onset of the Iran conflict.
This hacker group has consistently claimed allegiance with Iran’s notorious Islamic Revolutionary Guard Corps (IRGC). On July 22, the US Cybersecurity and Infrastructure Security Agency (CISA) issued warnings that the Cyberav3ngers, and by extension Iran, were likely in the process of targeting American systems.
The cyber onslaught has left a trail of compromised water control systems, with more than 30 instances reported in Michigan alone. These intrusions allowed hackers to expel system administrators and halt water distribution to facilities such as water towers, showcasing the severity of the breach.
No significant disruptions or harm came from the attacks and order was quickly restored at all sites, but so far nobody has claimed credit for the attacks — which prompted experts to caution the assault may still be underway, especially since the Cyberav3ngers appeared to be the culprits.
“Usually they’re pretty vocal,” Day said. “But in the past we’ve seen them when they started making claims it’s usually after the operation, so that makes me wonder, this operation may not be over.”
“Or they’re still wanting to try to extract maximum gain and notoriety out of it before they say anything,” he added.
And the attacks had the potential to be worse — with law enforcement sources telling The Post hackers could have gained access to systems which control and monitor the dosage of possibly dangerous chemicals in local water supplies.
There remains no concrete proof that the Cyberav3ngers were actually behind the attacks or are even IRGC proxies, but Day said the attacks bore all the fingerprints of both the group’s and Iran’s known tactics in cyberwarfare.
“They’ve always been kind of opportunistic, looking for exposed systems where they can leverage a known vulnerability,” Day said, calling the Cyberav3ngers a “mid-tier” threat-level.
“And they’re always acting as a proxy for the [Iranian] regime in some way,” he added.
The group has been around since at least 2020, and typically targets infrastructure systems within Iran’s enemies in the Middle East.
But the Cyberav3ngers hackers have previously targeted the US, with water systems being hit in Pennsylvania during a spate of attacks from Oct. 2023 to Jan. 2024, according to Tenable.
And while the US was able to easily mop up the effects of the latest attacks, Day cautioned that actions from the likes of the Cyberav3ngers expose cybersecurity vulnerabilities in US infrastructure — which at its worst could result in widespread blackouts and water stoppage.
“We’ve seen no indication that it’s going to get worse, we don’t expect to see a major escalation,” Day said. “But you have to be vigilant.”
Despite CISA and Tenable fingering the Cyberav3ngers as the likely culprit, the situation was cast into confusion Friday after President Trump denied any Iranian involvement — and instead blamed Minnesota’s “corrupt” Gov. Tim Walz.
“They blame it on Iran. I don’t think so,” Trump said. “I think I blame it on Minnesota, because they’re grossly incompetent.”
Walz then accused the president of deflecting.
“Trump knows exactly who is responsible for this attack, and knows that other states were hit too,” Walz wrote on X. “This is what modern warfare looks like, and it further illustrates there’s no plan to win a war with Iran.”