Iran-Linked CyberAv3ngers (IRGC Cyber Electronic Command) Suspected in Coordinated OT Attack Hitting 30+ Minnesota Community Water Systems

A coordinated cyberattack targeting operational technology at more than 30 Minnesota community water systems on July 26–27 forced the Braham water treatment plant offline and disrupted automated controls in Plymouth, South St. Paul, and Maple Plain — which declared a local state of emergency. CISA noted the activity bears hallmarks of operations previously attributed to CyberAv3ngers (Shahid Kaveh Group), the IRGC Cyber Electronic Command unit responsible for prior U.S. water utility attacks; a July 22 expansion of the federal advisory broadened the scope to include Schneider Electric and Siemens OT devices as affected platforms. MNIT activated statewide incident response and is coordinating with EPA, CISA, and federal partners; attribution remains unconfirmed pending active investigation.

CISA noted the activity bears hallmarks of operations previously attributed to CyberAv3ngers (Shahid Kaveh Group), the IRGC Cyber Electronic Command unit responsible for prior U.S.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.