{"id":6127,"date":"2026-08-04T13:37:56","date_gmt":"2026-08-04T13:37:56","guid":{"rendered":"https:\/\/metrotransitreview.com\/?p=6127"},"modified":"2026-08-04T13:37:56","modified_gmt":"2026-08-04T13:37:56","slug":"iran-backed-hackers-likely-behind-attack-that-shut-down-minnesota-water-plant-and-theyre-not-done-yet","status":"publish","type":"post","link":"https:\/\/metrotransitreview.com\/?p=6127","title":{"rendered":"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they’re not done yet"},"content":{"rendered":"
\n

A notorious Iran-linked hacker group was likely behind the recent attacks on dozens of water systems across the US \u2014 and the shadowy cyber-soldiers may not be done with their assault, experts warned.<\/p>\n

Read more Ex-Trump White House press secretary seeks restraining order against Rep. Max Miller<\/a><\/p>\n

The self-proclaimed \u201cCyberav3ngers\u201d group appeared to carry out the attacks which hit seven states in recent months, according to cybersecurity company Tenable, which told The Post the devious group began posting on the dark web about plans to hit the US within weeks of war breaking out with Iran.<\/p>\n

\u201cWe listened or observed them kind of declaring that they were going to start targeting US Water infrastructure in in North America,\u201d Tenable\u00a0Public Sector Chief Technology Officer Chris Day said. \u201cWe started tracking activity back in April, right around the beginning of the Iran War.\u201d<\/p>\n

And the group has long-proclaimed itself to be closely tied to Iran\u2019s brutal Islamic Revolutionary Guard Corps (IRGC), with the US Cybersecurity and Infrastructure Security Agency (CISA) also warning on July 22 that the Cyberav3ngers \u2014 and by proxy Iran \u2014 were likely targeting US systems.<\/p>\n

Those attacks resulted in dozens of internet-connected water control systems \u2014 over 30 in Michigan alone \u2014 being taken over by hackers, who booted administrators and prevented water from being pumped into systems like water towers.<\/p>\n

No significant disruptions or harm came from the attacks and order was quickly restored at all sites, but so far nobody has claimed credit for the attacks \u2014 which prompted experts to caution the assault may still be underway, especially since the Cyberav3ngers appeared to be the culprits. <\/p>\n

\u201cUsually they\u2019re pretty vocal,\u201d Day said. \u201cBut in the past we\u2019ve seen them when they started making claims it\u2019s usually after the operation, so that makes me wonder, this operation may not be over.\u201d<\/p>\n

\u201cOr they\u2019re still wanting to try to extract maximum gain and notoriety out of it before they say anything,\u201d he added.<\/p>\n

And the attacks had the potential to be worse \u2014 with law enforcement sources telling The Post hackers could have gained access to systems which control and monitor the dosage of possibly dangerous chemicals in local water supplies.<\/p>\n

There remains no concrete proof that the Cyberav3ngers were actually behind the attacks or are even IRGC proxies, but Day said the attacks bore all the fingerprints of both the group\u2019s and Iran\u2019s known tactics in cyberwarfare.<\/p>\n

Read more Greg Olsen is the wild card with Tony Romo\u2019s uncertain CBS future<\/a><\/p>\n

\u201cThey\u2019ve always been kind of opportunistic, looking for exposed systems where they can leverage a known vulnerability,\u201d Day said, calling the Cyberav3ngers a \u201cmid-tier\u201d threat-level.<\/p>\n

\u201cAnd they\u2019re always acting as a proxy for the [Iranian] regime in some way,\u201d he added.<\/p>\n

The group has been around since at least 2020, and typically targets infrastructure systems within Iran\u2019s enemies in the Middle East.<\/p>\n

But the Cyberav3ngers hackers have previously targeted the US, with water systems being hit in Pennsylvania during a spate of attacks from Oct. 2023 to Jan. 2024, according to Tenable.<\/p>\n

And while the US was able to easily mop up the effects of the latest attacks, Day cautioned that actions from the likes of the Cyberav3ngers expose cybersecurity vulnerabilities in US infrastructure \u2014 which at its worst could result in widespread blackouts and water stoppage.<\/p>\n

\n<\/div>\n

\u201cWe\u2019ve seen no indication that it\u2019s going to get worse, we don\u2019t expect to see a major escalation,\u201d Day said. \u201cBut you have to be vigilant.\u201d<\/p>\n

Despite CISA and Tenable fingering the Cyberav3ngers as the likely culprit, the situation was cast into confusion Friday after President Trump denied any Iranian involvement \u2014 and instead blamed Minnesota\u2019s \u201ccorrupt\u201d Gov. Tim Walz.<\/p>\n

\u201cThey blame it on Iran. I don\u2019t think so,\u201d Trump said. \u201cI think I blame it on Minnesota, because they\u2019re grossly incompetent.\u201d<\/p>\n

Walz then accused the president of deflecting.<\/p>\n

\u201cTrump knows exactly who is responsible for this attack, and knows that other states were hit too,\u201d Walz wrote on X. \u201cThis is what modern warfare looks like, and it further illustrates there\u2019s no plan to win a war with Iran.\u201d<\/p>\n

Read more Iran, Oman near deal to reopen Strait of Hormuz with both countries collecting \u2018service fee\u2019: report<\/a><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Nobody has claimed credit for the cyberattacks — prompting experts to caution there could be more coming<\/p>\n","protected":false},"author":1,"featured_media":6126,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-6127","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-us-news"],"yoast_head":"\nIran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they're not done yet - Metro Transit Review<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/metrotransitreview.com\/?p=6127\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they're not done yet - Metro Transit Review\" \/>\n<meta property=\"og:description\" content=\"Nobody has claimed credit for the cyberattacks -- prompting experts to caution there could be more coming\" \/>\n<meta property=\"og:url\" content=\"https:\/\/metrotransitreview.com\/?p=6127\" \/>\n<meta property=\"og:site_name\" content=\"Metro Transit Review\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-04T13:37:56+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/#\\\/schema\\\/person\\\/7cd7bd9683106710eed62ba5da559b14\"},\"headline\":\"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they’re not done yet\",\"datePublished\":\"2026-08-04T13:37:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127\"},\"wordCount\":730,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/metrotransitreview.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/8512ae126ed69f03c343ae6a061b7c6d.webp\",\"articleSection\":[\"US News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127\",\"url\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127\",\"name\":\"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they're not done yet - Metro Transit Review\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/metrotransitreview.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/8512ae126ed69f03c343ae6a061b7c6d.webp\",\"datePublished\":\"2026-08-04T13:37:56+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/#\\\/schema\\\/person\\\/7cd7bd9683106710eed62ba5da559b14\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127#primaryimage\",\"url\":\"https:\\\/\\\/metrotransitreview.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/8512ae126ed69f03c343ae6a061b7c6d.webp\",\"contentUrl\":\"https:\\\/\\\/metrotransitreview.com\\\/wp-content\\\/uploads\\\/2026\\\/08\\\/8512ae126ed69f03c343ae6a061b7c6d.webp\",\"width\":1200,\"height\":799},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/?p=6127#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/metrotransitreview.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they’re not done yet\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/#website\",\"url\":\"https:\\\/\\\/metrotransitreview.com\\\/\",\"name\":\"Metro Transit Review\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/metrotransitreview.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/metrotransitreview.com\\\/#\\\/schema\\\/person\\\/7cd7bd9683106710eed62ba5da559b14\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"http:\\\/\\\/metrotransitreview.com\"],\"url\":\"https:\\\/\\\/metrotransitreview.com\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they're not done yet - Metro Transit Review","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/metrotransitreview.com\/?p=6127","og_locale":"en_US","og_type":"article","og_title":"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they're not done yet - Metro Transit Review","og_description":"Nobody has claimed credit for the cyberattacks -- prompting experts to caution there could be more coming","og_url":"https:\/\/metrotransitreview.com\/?p=6127","og_site_name":"Metro Transit Review","article_published_time":"2026-08-04T13:37:56+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/metrotransitreview.com\/?p=6127#article","isPartOf":{"@id":"https:\/\/metrotransitreview.com\/?p=6127"},"author":{"name":"admin","@id":"https:\/\/metrotransitreview.com\/#\/schema\/person\/7cd7bd9683106710eed62ba5da559b14"},"headline":"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they’re not done yet","datePublished":"2026-08-04T13:37:56+00:00","mainEntityOfPage":{"@id":"https:\/\/metrotransitreview.com\/?p=6127"},"wordCount":730,"commentCount":0,"image":{"@id":"https:\/\/metrotransitreview.com\/?p=6127#primaryimage"},"thumbnailUrl":"https:\/\/metrotransitreview.com\/wp-content\/uploads\/2026\/08\/8512ae126ed69f03c343ae6a061b7c6d.webp","articleSection":["US News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/metrotransitreview.com\/?p=6127#respond"]}]},{"@type":"WebPage","@id":"https:\/\/metrotransitreview.com\/?p=6127","url":"https:\/\/metrotransitreview.com\/?p=6127","name":"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they're not done yet - Metro Transit Review","isPartOf":{"@id":"https:\/\/metrotransitreview.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/metrotransitreview.com\/?p=6127#primaryimage"},"image":{"@id":"https:\/\/metrotransitreview.com\/?p=6127#primaryimage"},"thumbnailUrl":"https:\/\/metrotransitreview.com\/wp-content\/uploads\/2026\/08\/8512ae126ed69f03c343ae6a061b7c6d.webp","datePublished":"2026-08-04T13:37:56+00:00","author":{"@id":"https:\/\/metrotransitreview.com\/#\/schema\/person\/7cd7bd9683106710eed62ba5da559b14"},"breadcrumb":{"@id":"https:\/\/metrotransitreview.com\/?p=6127#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/metrotransitreview.com\/?p=6127"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/metrotransitreview.com\/?p=6127#primaryimage","url":"https:\/\/metrotransitreview.com\/wp-content\/uploads\/2026\/08\/8512ae126ed69f03c343ae6a061b7c6d.webp","contentUrl":"https:\/\/metrotransitreview.com\/wp-content\/uploads\/2026\/08\/8512ae126ed69f03c343ae6a061b7c6d.webp","width":1200,"height":799},{"@type":"BreadcrumbList","@id":"https:\/\/metrotransitreview.com\/?p=6127#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/metrotransitreview.com\/"},{"@type":"ListItem","position":2,"name":"Iran-backed hackers likely behind attack that shut down Minnesota water plant \u2014 and they’re not done yet"}]},{"@type":"WebSite","@id":"https:\/\/metrotransitreview.com\/#website","url":"https:\/\/metrotransitreview.com\/","name":"Metro Transit Review","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/metrotransitreview.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/metrotransitreview.com\/#\/schema\/person\/7cd7bd9683106710eed62ba5da559b14","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/50b1ad2e498f523425ee0a8cc5180a210646db1622662a3d56cc405d3e0c346a?s=96&d=mm&r=g","caption":"admin"},"sameAs":["http:\/\/metrotransitreview.com"],"url":"https:\/\/metrotransitreview.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=\/wp\/v2\/posts\/6127","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6127"}],"version-history":[{"count":0,"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=\/wp\/v2\/posts\/6127\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=\/wp\/v2\/media\/6126"}],"wp:attachment":[{"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6127"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6127"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/metrotransitreview.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6127"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}