Hackers Exploit Exposed Industrial Controllers to Disrupt US Water and Critical Infrastructure
Attackers disrupted US water utilities via exposed Rockwell controllers, alongside other industrial-control campaigns.
86
Threat actor
CyberAv3ngers
- Mentions · 7d0
- Mentions · 30d2
- All mentions13
- First seenAug 20, 2026
- Last mentioned25d ago
Timeline
13 articles · newest firstOT Attacks on US Critical Infrastructure Could Disrupt Military Operations and Physical Processes
State-linked actors are targeting US critical-infrastructure OT, with confirmed water-system disruption and Volt Typhoon pre-positioning.
81
In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.
45
U.S. Offers $10 Million Reward for Iranian IRGC Cyber Chief Linked to Critical Infrastructure Attacks
The U.S. State Department offered up to $10 million for information on Amir Yaryab, an IRGC cyber chief linked to critical infrastructure attacks.
40
US offers $10 million for info on Iranian allegedly behind cyberattacks on critical infrastructure
State Department offers $10M reward for IRGC Cyber-Electronic Command chief Amir Yaryab over critical infrastructure cyberattacks across US, Europe, and Middle East.
62
Iranian APTs increased activity against US industries in late spring, researchers say
Nozomi Networks recorded 28 Iran-linked attacks on US customers in May-June, up 133%, mostly hitting transportation and manufacturing.
66
OpenAI disrupts 20 campaigns to misuse its tech as federal officials mull international use of AI
OpenAI disrupted 20+ nation-state operations misusing ChatGPT, including CyberAv3ngers using it for reconnaissance and malware code debugging.
60
US offering $10 million for info on Iranian hackers behind IOControl malware
US offers up to $10 million for information on CyberAv3ngers' 'Mr. Soul,' whose IOControl malware targets US and worldwide ICS/SCADA devices.
52
US offers $10 million for info on Iranian leaders behind CyberAv3ngers water utility attacks
The US offered $10 million for information on six IRGC-CEC officials behind CyberAv3ngers' 2023 hacks of Unitronics PLCs at US water utilities.
55
Florida water agency latest to confirm cyber incident as feds warn of nation
A ransomware gang hit Florida's St. Johns River Water Management District as CISA warned of IRGC-linked CyberAv3ngers attacks on exposed Unitronics water-sector PLCs.
72
Pro-Palestinian operation claims dozens of data breaches against Israeli firms
Hacktivist group Cyber Toufan claims 60 data breaches of Israeli and allied firms, wiping systems and erasing backups; Check Point links it to Iran.
72
US charges Iranians for sprawling hacking campaign on government agencies, universities
DOJ indicts 17 Iranians tied to Mabna Institute IRGC hacking-for-hire campaign that stole 31TB from universities, agencies, and UN organizations.
65
US agencies warn of AI-powered attacks on Siemens industrial controllers
NSA, CISA, FBI, DOE, and EPA warn threat actors use AI-assisted scripts and snap7 libraries to access internet-exposed Siemens S7 PLCs in critical infrastructure sectors.
70
Related CVEs
by mentions- CVE-2026-148943%9.8The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the…
Appears with
- CISAorganization · 7
- FBIorganization · 6
- Unitronicsvendor · 5
- EPAorganization · 4
- NSAorganization · 4
- IRGCorganization · 4
- Rockwell Automationvendor · 3
- Siemensvendor · 2
- Municipal Water Authority of Aliquippavictim · 2
- U.S. Justice Departmentorganization · 2
- Volt Typhoonthreat actor · 2
- U.S. State Departmentorganization · 2
- US State Departmentorganization · 2
- Unitronics Vision Series PLCproduct · 2
- Dadeh Afzar Armanthreat actor · 2
- Toyotavictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.