An Iran Cyber Threat Dossier for the 5–17 August 2026 Reporting Window

The campaign against United States drinking water and wastewater systems that began on 27 July 2026 has expanded from an initial federal count of seven states to at least twelve, has produced its first documented consequence at the consumer tap, and remains formally unattributed by the United States government. We assess with moderate confidence that the intrusions are the work of the Islamic Revolutionary Guard Corps Cyber-Electronic Command ecosystem — the actor set tracked publicly as CyberAv3ngers and, in Dragos nomenclature, as Bauxite — rather than the Ministry of Intelligence and Security-linked Handala Hack Team responsible for the war’s most prominent United States intrusions to date. That judgment rests on sector alignment, technique, timing, and historical precedent. It does not rest on claimed responsibility. No actor has claimed these attacks.

Two findings in this window matter more than the state count. The first is a correction that should be made before any further publication on this topic. There was no new Treasury sanctions action against Iranian Revolutionary Guard cyber officials on 17 August 2026. The designation of six Cyber-Electronic Command officers, including command head and Quds Force officer Hamid Reza Lashgarian, is dated 2 February 2024 and was issued over the 2023 Unitronics programmable logic controller attacks. Reporting that places that action in August 2026, or that characterizes it as the first United States move against Cyber-Electronic Command leadership, is inaccurate on both counts.

The second finding undercuts the official numbers from below. At least one affected Georgia utility has confirmed on the record that it never notified the Federal Bureau of Investigation, the Environmental Protection Agency, or state regulators, because it observed no operational consequence. The twelve-state figure therefore measures reporting behavior, not intrusion volume. It is a floor.

The operational picture is less sophisticated and more alarming than the political framing suggests. Vendor telemetry indicates activity consistent with mass scanning and enumeration of internet-exposed controllers rather than zero-day exploitation or long-dwell intrusion. The affected devices did not need to be hacked in any demanding sense. They were reachable, and in many cases they were reachable over commercial cellular networks that utility operators did not know were exposed.

Three developments defined the Iranian cyber threat picture for United States critical infrastructure between 5 and 17 August 2026.

The water sector campaign broadened and produced its first tap-level effect. The Bureau and the Environmental Protection Agency initially reported incidents across at least seven states following coordinated activity beginning 27 July. By the first week of August, national reporting had confirmed a dozen. Minnesota remains the epicenter, with state technology officials documenting more than thirty affected community water systems. Michigan, South Dakota, Georgia, and New Jersey are additionally confirmed. In Clayton County, Georgia, a system serving roughly three hundred thousand residents in metropolitan Atlanta, a pump station failure in the early hours of 27 July dropped system pressure and triggered a precautionary boil-water advisory, lifted the following day after water quality testing returned clean. That advisory is the first confirmed consequence of the campaign experienced by consumers. No contamination and no illnesses have been confirmed anywhere in the campaign.

Attribution remains officially unmade, and the reason is instructive. Reporting in the second week of August indicated that the intelligence community is confident the Revolutionary Guard is responsible but has withheld formal attribution, in part because analysts disagree over which Guard component conducted the operations, and in part out of institutional reluctance to contradict the President, who has publicly blamed Minnesota state government rather than Iran. Investigators have separately examined whether an actor deliberately constructed indicators to appear Iranian. That hypothesis has not been substantiated, but neither has it been closed, and any responsible published assessment must carry it.

The policy response accelerated while a critical legal authority moved toward expiration. Senators Amy Klobuchar and Adam Schiff introduced the Water Cyber Shield Act on 10 August, authorizing an additional three hundred million dollars annually through the state revolving funds for water sector cybersecurity, granting the Environmental Protection Agency assessment and corrective-action authority, extending federal incident reporting to state and locally owned systems, and directing tiered standards developed in consultation with the Cybersecurity and Infrastructure Security Agency and the National Institute of Standards and Technology. Simultaneously, the liability and antitrust protections of the Cybersecurity Information Sharing Act of 2015 are scheduled to lapse on 30 September 2026 following a series of short-term extensions. If they lapse mid-campaign, the legal foundation for utility-to-federal threat sharing weakens at precisely the moment it is being exercised most heavily.

A fourth point is analytic rather than event-driven. Much of what circulated in August as new threat-group reporting was syndication of first-party research published between February and July. This includes the Symantec analysis of Seedworm operations against a United States bank, airport, and nonprofit; the Israeli advisories on the APT42 SpearSpecter campaign; the MuddyWater reconnaissance findings; the reporting on telephony protocol abuse to locate American troops; and the Handala statement declaring a pause on United States targeting. All are genuine. None is new to this window. Analysts and editors working this story should date each to its original publication rather than to its August recirculation.

The claim that Treasury designated six Revolutionary Guard Cyber-Electronic Command officials on 17 August 2026 does not survive contact with the primary record. The relevant press release is dated 2 February 2024. It named Hamid Reza Lashgarian, who heads the Cyber-Electronic Command and holds a Quds Force commission, along with Mahdi Lashgarian, Hamid Homayunfal, Milad Mansuri, Mohammad Bagher Shirinkar, and Reza Mohammad Amin Saberian. The authority was the counterterrorism sanctions framework under Executive Order 13224, and the predicate was the November and December 2023 exploitation of Unitronics controllers at water facilities, including the Municipal Water Authority of Aliquippa, Pennsylvania. Six individuals were designated. No entities were included. The frequently quoted characterization of infrastructure targeting as unconscionable and dangerous belongs to the Under Secretary for Terrorism and Financial Intelligence serving in 2024, in that release.

Nor was that action either the first or the last of its kind. In April 2024, Treasury designated two Cyber-Electronic Command front companies alongside four additional individuals, in an action coordinated with a Justice Department indictment. The State Department maintains a ten-million-dollar reward offer for information on foreign government-directed cyber operations against United States critical infrastructure, which open-source analysis has connected to the CyberAv3ngers persona known as Mr. Soul.

As of publication, Treasury’s recent actions record for mid-August 2026 reflects designations concerning Revolutionary Guard-linked cryptocurrency exchanges, Strait of Hormuz maritime extortion, and weapons procurement networks. It does not reflect a new cyber action against Cyber-Electronic Command personnel over the water campaign. That absence is itself analytically significant. Eighteen months of accumulated designations have not altered the behavior, and the United States has not yet answered the 2026 campaign with the instrument it reached for in 2024.

The technique across affected utilities was uniform and unremarkable. Actors reached internet-exposed programmable logic controllers and human-machine interfaces, altered device addressing and credentials to lock out legitimate operators, and forced reversion to manual operation. Federal notification described observed effects including loss of pressure and localized flooding. In Braham, Minnesota, malware was introduced across a wireless link. In Plymouth, the exposed asset set included two water towers and fourteen sewer lift stations reachable through cellular routers.

Georgia produced both the campaign’s clearest consumer impact and its clearest evidence of statistical undercount. Beyond the Clayton County boil-water advisory, Columbus Water Works confirmed a 27 July incident, with the local emergency management director stating publicly that water supply and quality were never threatened. Coweta County Water and Sewerage Authority also confirmed an incident, and its chief executive stated plainly that because the utility observed no operational consequence, it filed nothing with federal or state authorities. That single admission means the federal count is a measure of notification practice rather than of intrusion scope.

Given that the sector comprises roughly fifty thousand community water systems, most of them small, understaffed, and outside any mandatory reporting regime, we assess with high confidence that the true number of affected utilities exceeds the publicly confirmed figure, and with moderate confidence that it exceeds it substantially. Journalists working this story should treat every official count as provisional and should ask utilities directly rather than relying on aggregate federal tallies.

Vendor scan data published in early August, based on a 3 August snapshot, identified 4,407 internet-facing Rockwell Automation and Allen-Bradley controllers exposing the EtherNet/IP service on port 44818 worldwide. Of those, 2,844, or sixty-five percent, were located in the United States, with Canada and Spain distant seconds. The global figure had risen from a June low of 4,169, though it remains roughly forty-seven percent below the 2020 peak. The MicroLogix 1400 family accounted for half of all results.

Two details in that dataset carry disproportionate operational weight. First, twenty-two exposed controllers were located in cities with reported attacks, and nineteen of those twenty-two ran firmware susceptible to a 2017 Modbus buffer overflow in the MicroLogix 1400 series, remediated by a firmware revision that has been available for nine years. Second, more than seventy percent of the exposed United States controllers sat on major mobile carrier networks, apparently without a private access point name or correctly configured inbound filtering. Independent exposure observation from late July, using different methodology and a different target set, found comparable carrier concentration. These are field-deployed assets at pump stations and lift stations, connected by cellular modem, frequently holding routable public addresses, and in many cases absent from the utility’s own asset inventory.

The most important caveat in the exposure story comes from the research team that produced it. The firm could not confirm that any specific exposed device was compromised, and it noted that the operational effects described in this campaign require no vulnerability exploitation at all. Its threat hunting lead characterized the activity as opportunistic exploitation at scale against a known vulnerability class, more consistent with mass scanning and enumeration than with zero-day use, months-long intrusion, or bespoke malware. Analysts should resist the temptation to read state sophistication into a campaign whose defining input was reachability.

The federal joint advisory covering this activity, originally issued 7 April 2026 with participation from the Cybersecurity and Infrastructure Security Agency, the Bureau, the National Security Agency, the Environmental Protection Agency, the Department of Energy, and Cyber Command’s Cyber National Mission Force, was updated on 22 July to extend coverage beyond Rockwell to Schneider Electric Modicon and Siemens S7 controllers, to document project-file exfiltration for the first time, and to add detection guidance for manipulated reusable code modules. A Rockwell Logix authentication bypass carrying a 9.8 severity score and no vendor patch was added to the Known Exploited Vulnerabilities catalog in March 2026 following confirmed Iranian exploitation. Observed tradecraft includes deployment of lightweight SSH servers on controllers and manipulation of supervisory displays to suppress shutdown and alarm logic. The significance of that last technique is that it degrades the operator’s picture rather than the plant’s function, which is a harder failure to detect and a slower one to correct.

CyberAv3ngers, also tracked as Bauxite (Cyber-Electronic Command). The priority actor and the best fit for the water campaign. Its custom modular Linux implant, documented in December 2024, uses encrypted publish-subscribe messaging over port 8883 and DNS-over-HTTPS for command and control, and targets fuel dispensing systems, Unitronics and Rockwell controllers, and consumer network and camera devices. The research team’s assessment that the tool functions as a nation-state weapon aimed at civilian infrastructure remains the clearest capability judgment in the open literature. The 2026 evolution is a shift toward exploiting the unpatched Logix authentication bypass. Two aliases in wide circulation for this actor could not be confirmed against vendor primary sources in this cycle and should be verified before use in print.

Handala Hack Team, also tracked as Void Manticore (Ministry of Intelligence and Security). Conducted the war’s most consequential United States intrusions, including the March destruction of data at a major medical device manufacturer through compromised enterprise device management, and the compromise of senior federal officials’ communications. It did not claim the water attacks. Its declared pause on United States targeting, accompanied by a statement that the cyber war would not end with a military ceasefire, dates to April, following the ceasefire of 8 April, and not to August. The group’s associated ransomware brands are analytically significant beyond extortion: research into the Sicarii family identified a key-handling defect that discards the private key after encryption, rendering victim data unrecoverable even upon payment. Whether by design or by incompetence, the effect is destruction disguised as extortion, which aligns with Ministry doctrinal preference for irreversible outcomes. Affiliates were redirected to a successor brand in early March. A senior Void Manticore officer was killed in Israeli strikes in early March 2026.

APT42, also tracked as Charming Kitten (Revolutionary Guard intelligence). Represents the window’s most consequential tradecraft development, though the underlying research dates to late July. The campaign chain abuses the Windows search protocol handler to retrieve a shortcut file masquerading as a document from a WebDAV share, executing fileless PowerShell that stages a modular implant. Command and control runs over consumer platforms, specifically Discord and Telegram, which are difficult to block in enterprise environments without collateral disruption. Credential access includes browser cookie theft through the Chromium remote debugging interface and process suspension against Chrome. Targeting extends to family members of defense and government officials, a deliberate move outside the perimeter of enterprise defenses. The defensive conclusion in the original research is the single most portable finding of this window: language quality is now a weak phishing indicator. Grammar-based user training and syntax-based mail filtering have lost their discriminating power against this actor.

MuddyWater, also tracked as Seedworm (Ministry of Intelligence and Security). Conducted broad reconnaissance across more than twelve thousand internet-exposed systems, chaining known vulnerabilities in mail server, workflow automation, remote monitoring, low-code AI orchestration, and PHP framework products, with infrastructure traced to a Netherlands-hosted server. The campaign pivoted from enumeration to credential harvesting and exfiltration against aviation, energy, and government targets in Egypt, Israel, and the United Arab Emirates. One of the exploited vulnerabilities entered the Known Exploited Vulnerabilities catalog in May 2026 and should be treated as a remediation priority. Separate documentation of Seedworm presence on a United States bank, an airport, a nonprofit, and the Israeli operations of an American software supplier, using two distinct backdoors, is dated 5 March 2026.

UNC1549, also tracked as Nimbus Manticore. Developed and deployed six new remote access tool variants between February and April 2026 against United States, Israeli, and Emirati targets, routing command and control through several cloud-hosted domains per target and per variant, and using library sideloading and application domain manipulation for execution. One component shows characteristics consistent with machine-assisted code generation. Reporting that attaches a figure of thirty-four devices across eleven organizations to this 2026 activity is conflating it with September 2025 research on the same actor.

Emennet Pasargad. Operating since mid-2024 under a renamed entity, this group drew European sanctions designations in March and April 2026, following the 2024 joint advisory that documented its harvesting of internet-exposed camera feeds and its use of generative artificial intelligence for influence operations. Its current operational status is contested in open source, with competing assessments of kinetic disruption against continued activity under reduced visibility.

OilRig, Agrius, Dust Specter, Pyroxene, and Fox Kitten. No confirmed new campaign reporting in this window. Prior attributions and toolsets should be presented as background rather than as current activity.

The most strategically significant Iranian cyber development of the summer is not infrastructure disruption but signals intelligence. Reporting in mid-July, based on named mobile network security research and anonymous official sourcing, described Iranian abuse of the legacy Signaling System 7 telephony protocol to determine the locations of United States military personnel in Iraq, Bahrain, and elsewhere, with the resulting geolocation informing strikes that caused casualties. We assess this with moderate confidence given its single-primary-source posture, and we flag it as the clearest available evidence that Iranian cyber capability has been placed in direct support of kinetic targeting.

That transition changes the retaliation calculus. Infrastructure harassment invites sanctions and advisories. Contributing to the targeting of American service members invites something else, and the absence of a visible United States response to date is a gap that analysts should track rather than assume away.

The most useful strategic framing published in this window arrived on 6 August, arguing that Iran’s cyber apparatus has regeared in direct alignment with wartime objectives across six activity categories: espionage, access development, disruption, cyber-enabled influence, spyware deployment, and conflict-themed criminal activity. The analysis is notable for its restraint. Its throughline is that Iranian cyber capability confers an incremental rather than a revolutionary advantage, and that analysts should be careful not to mistake operational volume for strategic effect. That caution should govern coverage of the water campaign as well.

For editors and analysts working from secondary summaries, the following claims in wide circulation are dated incorrectly or remain unverified against primary sources, and should not be published without independent confirmation.

The six-official Treasury designation is February 2024, not August 2026, and was not the first action naming Cyber-Electronic Command leadership. The Handala statement declaring a pause on United States targeting is April 2026. The Symantec Seedworm findings are 5 March 2026. The telephony protocol troop-tracking reporting is mid-July 2026. The Montenegro arrest of the Iranian-Turkish national sought by the Southern District of New York for intrusions against more than one hundred fifty American universities occurred in late June 2026, with extradition proceedings continuing and no developments identified after 5 August. Reporting that the President rejected preliminary intelligence findings on Iranian responsibility is accurate but dates to 31 July, not to mid-August. The International Atomic Energy Agency board document frequently cited as an August status report is dated 27 February 2026; the relevant June documents carry different numbers.

On the kinetic timeline, the ceasefire in this conflict was concluded on 8 April 2026 with Pakistani mediation, not in mid-June. A subsequent June memorandum addressed blockade removal and a sixty-day safe passage period, after which the naval blockade was reimposed. Numerous discrete diplomatic and military claims circulating for the 5 to 17 August period, including specific statements by administration principals, individual vessel incidents, the Supreme National Security Council leadership change, and a target list attributed to Iranian state media, were not independently verified in this cycle and require individual sourcing before use.

Finally, the bill number attached to the Water Cyber Shield Act in secondary coverage could not be confirmed against the congressional record, although sponsorship, introduction date, and substantive provisions are confirmed. Two vendor aliases commonly applied to CyberAv3ngers, and a United Nations designation date commonly attached to Emennet Pasargad, likewise could not be confirmed.

Four developments would materially change this assessment. A formal United States attribution naming a specific Revolutionary Guard component would resolve the central analytic gap and would likely precede a sanctions or indictment action. A claim of responsibility by any actor, Iranian or hacktivist or criminal, would either confirm or collapse the current attribution. Forensic confirmation of water quality impact or illness in any affected system would transform the campaign’s political and regulatory trajectory. And a new Treasury or Justice action against Cyber-Electronic Command personnel would signal that the intelligence picture has firmed sufficiently to support named accountability.

Two structural indicators deserve monitoring on a shorter cycle. The first is the 30 September expiration of information-sharing liability protection, which will either be reauthorized, extended again, or allowed to lapse during an active campaign against the sector least equipped to absorb the loss. The second is the internet-exposure count itself. If exposed controller totals continue rising from the June low while the campaign proceeds, that is evidence the sector’s remediation capacity is being outpaced by its own deployment of remotely reachable field assets.

The remediation path here is unusually clear, which is what makes the persistence of the problem notable. Programmable logic controllers and human-machine interfaces should not be reachable from the public internet. Where cellular connectivity is operationally necessary for remote field assets, gateways belong on a private access point name or behind a virtual private network with multifactor authentication, never on a routable public address accepting inbound connections. Explicit allow-listing should govern EtherNet/IP and Modbus TCP exposure. Default and vendor-documented credentials must be eliminated; the sector’s recent history demonstrates that a single well-known default password has been sufficient for repeated compromise across multiple years and multiple campaigns.

On vulnerability management, defense in depth is required for the unpatched Rockwell Logix authentication bypass, and firmware remediation for the 2017 MicroLogix overflow is nine years overdue in most exposed deployments. The MuddyWater exploitation set, particularly the catalog-listed low-code orchestration flaw, warrants immediate patch verification in enterprise environments adjacent to operational technology.

Against APT42, grammar-based phishing awareness training should be retired as a primary control. Detection should focus instead on search protocol handler invocation, WebDAV retrieval of shortcut files, PowerShell execution originating from those chains, outbound connections to consumer messaging platforms from workstations with no business justification, and Chromium remote debugging port activity. Response should assume session and token theft rather than password compromise alone, which means revoking sessions, auditing consent grants, and inspecting mailbox forwarding rules rather than resetting credentials and closing the ticket.

For utilities without internal security staffing, which describes most of the affected population, the practical starting point is an external exposure assessment covering cellular-attached field assets. The recurring failure mode in this campaign was not defensive weakness. It was the absence of any knowledge that the asset was reachable at all.