Iranian Cyber Actors Target US Water Infrastructure: FBI and EPA Issue Urgent Critical Infrastructure Alert

Executive Summary

On August 6, 2026, the FBI and the Environmental Protection Agency (EPA) issued a joint intelligence bulletin regarding a surge in malicious cyber activity targeting United States water and wastewater systems (WWS). Intelligence indicates that Iranian-linked advanced persistent threat (APT) actors have successfully gained unauthorized access to several facilities, primarily in the Midwest, including Minnesota. These actors are reportedly tampering with chemical levels and pump controls, representing a significant escalation in nation-state targeting of civilian critical infrastructure, as reported in US water facilities targeted by ‘malicious cyber actors’ – who’s to blame?.

Threat Analysis

The current campaign marks a departure from traditional espionage toward active operational disruption. While previous Iranian operations focused on reconnaissance or data exfiltration, the 2026 campaign demonstrates a willingness to cross red lines regarding public safety. The actors are leveraging a combination of known vulnerabilities in legacy Industrial Control Systems (ICS) and sophisticated "Living-off-the-Land" (LotL) techniques to evade detection. By using legitimate system tools like PowerShell and WMI, the attackers maintain persistence without triggering traditional signature-based antivirus solutions, a trend noted in APTs in 2026: Nation-State Tactics, Techniques, and How to Defend ....

Technical Details

The primary entry vector identified in recent breaches involves the exploitation of exposed Remote Desktop Protocol (RDP) instances and unpatched Virtual Private Networks (VPNs). Once inside the network, the actors move laterally to the Operational Technology (OT) environment. Specifically, researchers have observed the deployment of custom scripts designed to interact with Programmable Logic Controllers (PLCs). In one instance, the actors attempted to alter the dosage of water treatment chemicals by manipulating the Human-Machine Interface (HMI). This follows warnings from Several states report cyberattacks as spy agencies suspect Iran targeting water regarding remote tampering.

Attribution Assessment

The FBI and CISA have expressed high confidence that the activity is orchestrated by actors affiliated with the Iranian Government. Technical signatures, including the use of the "Screening Serpens" (also known as APT33) toolset and infrastructure previously linked to the "Charming Kitten" (APT35) group, support this assessment. Detailed tracking of these groups in Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns highlights their evolving capabilities in targeting critical infrastructure. The timing of these attacks coincides with heightened geopolitical tensions, suggesting these operations serve as a "gray zone" retaliatory measure.

Implications

The targeting of water infrastructure poses a direct threat to public health and national security. Beyond the immediate physical risks, these attacks serve as a psychological operation intended to undermine public trust in government-managed utilities. Furthermore, the success of these intrusions may embolden other nation-state actors to accelerate their own pre-positioning efforts within Western critical infrastructure, as discussed in Cyber Warfare 2026: Nation-State Attacks & Global Risk.

Recommendations

Encrygma recommends that all critical infrastructure operators immediately implement the following:

1. Enforce phishing-resistant Multi-Factor Authentication (MFA) for all remote access.
2. Isolate OT networks from the public internet and implement strict network segmentation between IT and OT environments.
3. Conduct immediate audits of all HMI and PLC configurations to ensure no unauthorized changes have been made.
4. Review CISA’s latest "Cross-Sector Cybersecurity Performance Goals" (CPGs) to close implementation gaps.