Federal investigators broadened a probe of coordinated cyberattacks on U.S. drinking-water utilities Saturday after Michigan became the latest state to report intrusions, adding to a wave that has hit at least 30 community water systems in Minnesota and that the FBI, EPA and Cybersecurity and Infrastructure Security Agency are examining for links to Iran.
The spreading attacks land as President Trump publicly rejected the emerging attribution, telling reporters "I don’t think there was an Iranian cyberattack" and blaming Minnesota Governor Tim Walz, The Verge reported. Federal agencies have stopped short of officially naming Iran, but consensus among investigators is that Iran is likely behind the intrusions, The Verge said. Investigators are examining incidents across seven states, according to CBS News.
CISA has previously linked cyberattacks on U.S. water systems this year to Iranian-affiliated actors. Iran has turned repeatedly to digital sabotage as its conventional military options have narrowed during the U.S.-Iran war.
A 2023 template
The Minnesota intrusions echo a 2023 breach in Aliquippa, Pa., in which a group calling itself CyberAv3ngers — described by CISA as affiliated with Iran's Islamic Revolutionary Guard Corps — shut down water-pumping equipment and left compromised devices displaying the message "You have been hacked, down with Israel," CBS News reported. The group exploited programmable logic controllers made by Israeli manufacturer Unitronics that had no password or were still running default credentials. CISA said this week's Minnesota intrusions targeted the same class of device.
Iranian-linked hackers have repeatedly hit accessible U.S. targets over the past decade. Seven Iranians tied to companies connected to the IRGC were charged with distributed denial-of-service attacks against 46 U.S. financial institutions between 2011 and 2013 that disabled bank websites and cost customers and banks tens of millions of dollars in remediation, according to a Justice Department indictment cited by CBS News. One defendant in the same case was charged with accessing the control system for the Bowman Avenue Dam in Rye, N.Y., in 2013, though the sluice gate used to regulate water levels was disconnected for maintenance at the time.
The attribution gap
Official confirmation of a nation-state actor typically takes weeks or months, CBS News reported, and investigators are also examining whether another actor could have staged the intrusions to appear Iran-based amid the U.S.-Iran war. Iran has long denied involvement in cyber operations against the United States.
Trump has clashed repeatedly with Walz during his second term and previously threatened to invoke the Insurrection Act against Minnesota during a surge of Immigration and Customs Enforcement operations in the state that left multiple people dead, The Verge reported. The president has not offered technical evidence tying the water intrusions to a state government.
The FBI warned this week that the cyberattacks were spreading beyond Minnesota, and Michigan's Saturday disclosure followed. The Unitronics controllers now under scrutiny are the same class of device whose default and missing passwords let CyberAv3ngers stop Aliquippa's water pumps in 2023.