Iran-Linked Cyber Campaign Disrupts Water Infrastructure Across 12 U.S. States

Executive Summary\nAs of August 9, 2026, federal investigators and cybersecurity agencies are responding to a widespread and coordinated cyber campaign targeting municipal water and wastewater systems across at least 12 U.S. states. The attacks, which began escalating in late July, have resulted in operational disruptions, including unauthorized pressure changes and flooding at facilities in Minnesota, Michigan, and Georgia. This campaign represents a significant escalation in the targeting of U.S. critical infrastructure, shifting from passive reconnaissance to active sabotage of essential services.\n\n## Threat Analysis\nThe current threat landscape for Operational Technology (OT) has shifted dramatically. Unlike previous years where state-sponsored actors focused on long-term persistence and espionage, the current campaign demonstrates a clear intent to cause physical disruption. By targeting the logic of Programmable Logic Controllers (PLCs), attackers have successfully triggered boil-water notices and forced manual overrides at several small-to-mid-sized utilities. The vulnerability of these systems stems from their direct exposure to the public internet and the use of legacy protocols that lack robust authentication, making them "soft targets" for geopolitical retaliation.\n\n## Technical Details\nThe primary vector involves the exploitation of internet-connected PLCs from manufacturers including Rockwell Automation, Schneider Electric, and Siemens. Attackers are utilizing a combination of default credential spraying and the exploitation of recently identified vulnerabilities in reusable code modules. Intelligence suggests the use of a new malware strain dubbed "SpecterFlow," an AI-assisted .NET toolset capable of automating the discovery of OT assets and modifying PLC logic without triggering standard threshold alarms. This AI-enhanced reconnaissance allows the actors to identify specific configurations within the water sector that lack dedicated OT security monitoring or air-gapping.\n\n## Attribution Assessment\nEncrygma analysts, in alignment with recent CISA and FBI reporting, attribute this activity with high confidence to Iranian-affiliated threat actors, specifically a group tracked as "Dust Specter" (also known as IRGC-Nexus). The tactics, techniques, and procedures (TTPs) mirror previous Iranian operations targeting Israeli water infrastructure, now adapted for the U.S. regulatory environment. The timing of these attacks coincides with heightened geopolitical tensions, suggesting a retaliatory motive intended to project power through domestic disruption.\n\n## Implications\nThe implications of these attacks are severe. Beyond the immediate operational disruption, there is a critical risk of untreated groundwater seeping into distribution pipes due to pressure loss, posing a direct threat to public health. Furthermore, the success of this campaign against the water sector may embolden similar attacks against the power grid and transportation networks, which rely on similar PLC architectures. The psychological impact on public trust in municipal infrastructure is a primary objective of the adversary.\n\n## Recommendations\nOrganizations must immediately audit all OT environments to ensure no PLCs are directly accessible via the public internet. Key mitigations include:\n1. Implementing robust Multi-Factor Authentication (MFA) for all remote access points.\n2. Changing all default administrative passwords on ICS/SCADA hardware immediately.\n3. Deploying network segmentation to isolate OT networks from IT environments.\n4. Monitoring for unauthorized changes in PLC reusable code modules as per CISA Advisory AA26-097A.\n5. Establishing manual override procedures to maintain service during digital outages.