Iran-linked hackers linked to series of U.S. cyber incidents spanning banks to water systems
U.S. investigators are examining whether Iranian state-affiliated groups are responsible for recent attacks on water utilities in several states, adding to a decade-long record of cyber operations targeting American institutions.
Federal investigators are assessing whether Iranian-linked hackers were behind a wave of malicious activity that disrupted water and wastewater systems in seven U.S. states, including Minnesota. The inquiry follows similar incidents in 2023 that shut down water pumping equipment in Pennsylvania.
U.S. officials say Iranian actors have repeatedly exploited vulnerabilities in publicly accessible networks to cause disruption, gather intelligence and generate publicity. The Justice Department has previously charged individuals connected to the Islamic Revolutionary Guard Corps for distributed denial-of-service attacks on 46 banks between 2011 and 2013, and for accessing the control system of a New York dam in 2013.
In 2014, the Las Vegas Sands casino reported that hard drives were wiped and customer data stolen after a hack that also defaced its websites with anti-Iran rhetoric. Former Director of National Intelligence James Clapper publicly attributed that intrusion to Iran.
A later indictment disclosed that Iranian-affiliated groups targeted the State Department, Treasury, defense contractors and other private firms from 2016 through 2021, using a front company that claimed to provide cybersecurity services. The FBI and CISA have warned that a group known as “Pioneer Kitten” compromised schools, municipal governments, health-care providers and financial institutions from 2017 to 2024, often handing access to ransomware affiliates.
Other notable incidents include the hacking of former national-security adviser John Bolton’s email account (2019-2021), attempts to influence the 2020 election through deceptive emails and voter-data theft, and a thwarted 2021 attack on a Boston children’s hospital.
More recently, a faction calling itself “CyberAv3ngers,” linked to the IRGC, exploited programmable logic controllers used in water infrastructure, displaying messages such as “You have been hacked, down with Israel.” The same tactics were observed in the current Minnesota water-system incidents.
In 2024, three Iranian nationals and IRGC employees were indicted for hacking accounts tied to a U.S. presidential campaign, allegedly to sow discord and gather intelligence related to the 2020 killing of IRGC commander Qasem Soleimani. The Trump campaign confirmed it had been breached, while the FBI also examined possible targeting of the Biden-Harris campaign.
"These operations aim to intimidate, create disruption and undermine confidence in U.S. institutions," a Justice Department spokesperson said.
The Justice Department continues to monitor and prosecute Iranian-linked cyber activity, including recent seizures of websites used by groups such as Handala to claim credit for attacks on medical-technology firms.