Iranian hackers suspected of attacking 30 Minnesota water companies

Iranian hacker collective CyberAv3ngers is the main suspect in a series of cyber attacks that hit 30 different water companies across the state of Minnesota this week.

That’s according to security research firm Tenable, which claims the attacks are consistent with CyberAv3ngers’ past exploits.

Meanwhile, Minnesota’s state IT agency claimed the disruption was the result of a “coordinated cyberattack.”

Tenable not only believes the attack to be the work of CyberAv3ngers, but also says the timing of the attack is “significant” given a July 22 report from the US Cybersecurity and Infrastructure Security Agency (CISA).

In it, the CISA warned that Iranian actors were actively targeting internet-connected devices, such as programmable logic controllers, across US water, energy, and government sectors.

Tenable also warned that the US war with Iran means “Iranian cyber operations have escalated in parallel with kinetic hostilities, with confirmed targeting of U.S. critical infrastructure.”

It’s worth noting that US authorities are yet to attribute the attack.

Cybersecurity firm Sophos reports that CyberAv3ngers has claimed responsibility for a 2020 Israeli cyber attack that targeted 150 railway system servers and 28 railway stations.

Three years later, the group appeared to try to sell the data stolen from the railway hack for four $BTC, worth $108,000 at the time of the data listing.

In 2025, internal CyberAv3nger documents were leaked that included domain registrations, $BTC transactions, and European virtual private server hosting.

Tenable says these details overlapped with another group called Moses Staff, and revealed CyberAv3ngers’ structure as a “single coordinated effort directed by the state” instead of multiple Iranian individuals.