Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems
Security researchers suspect the Iran-linked group CyberAv3ngers was behind a coordinated cyberattack that disrupted over 30 water facilities in Minnesota. The attacks targeted operational technology, prompting state agencies to coordinate a response and issue limited water-use advisories in some communities. No official attribution has been confirmed, but the pattern aligns with previous activities linked to Iran’s IRGC cyber unit.
- ▪Tenable analysts identified the attack pattern as consistent with the CyberAv3ngers group, which is believed to be connected to Iran’s Islamic Revolutionary Guard Corps.
- ▪More than 30 Minnesota community water systems experienced disruptions on July 26-27, leading some cities to issue temporary water-use restrictions.
- ▪The Cybersecurity and Infrastructure Security Agency (CISA) had issued an advisory days earlier warning of Iran-linked actors targeting programmable logic controllers in critical infrastructure.
- ▪State officials emphasized a whole-of-government response, working with partners to restore services and strengthen future defenses.
The Register publishes from United Kingdom and files mainly under tech. We currently carry 339 of its stories.
Story provenance
Source · retrieval · rights · ranking — open for full record
inspect →
Story provenance
Attribution is not the same as permission. This drawer separates discovery metadata, excerpts, WeSearch-generated summaries, reuse status, and whether the publisher receives the visit. Nothing here claims a legal grant the publisher has not made.
Record
| Original publisher | The Register |
| Canonical URL | https://www.theregister.com/security/2026/07/29/iran-linked-cyberav3ngers-suspected-in-attacks-on-minnesota-water-systems/5280357 |
| Publication time | Wed, 29 Jul 2026 15:49:00 +0200 |
| Retrieval time | 2026-07-29T13:53:12.332Z |
| Last seen | 2026-07-29T13:53:12.332Z |
| Headline source | Publisher (no WeSearch rewrite) |
| Excerpt source | publisher body |
| Excerpt method | First ~120 words (~800 chars) of extracted publisher body, fair-use limited. |
| Summary | WeSearch · cerebras-chat (WeSearch summarizer) |
| Summary source text | contentText |
| Citation coverage | Summary is a WeSearch-generated derivative; primary citation is the original publisher URL. |
| Cluster | 5vtf-x1DJD0X · 1 stories |
| Cluster logic | Grouped by semantic title/content similarity across sources within a rolling window. Same-publisher template collisions are excluded from coverage comparison. |
| Ranking reason | Story pages are not engagement-ranked. Hub feeds use recency, with optional source-diversified chronological ordering (cap consecutive stories per source). No personalized ranking. |
| Publisher visit | Yes — open original |
| Substitutes article? | No — link-out required for full text |
Rights status (four layers)
WeSearch handling by dimension
| Indexing | May the item be indexed (stored, ranked, made findable)? | Allowed |
| Snippet | May a short excerpt of the publisher's text be shown? | Allowed |
| AI summary | May WeSearch generate its own short summary of the article? | Limited |
| Retrieval / RAG | May the content be exposed for third-party retrieval-augmented generation? | Not asserted |
| Model training | May the content be used to train AI models? | Not asserted |
| Commercial reuse | May the content be reused commercially? | Not permitted |
Basis: Derived from the published RSS/Atom feed. Contact: [email protected]. Reviewed: 2026-07-24.
Opening excerpt (first ~120 words) tap to expand
(function() { let windowUrl = window.location.href; windowUrl = windowUrl.substring(windowUrl.indexOf('?') + 1); let messageElement = document.querySelector('.shareableMessage'); if (windowUrl && windowUrl.includes('code') && windowUrl.includes('expires')) { messageElement.style.display = 'block'; } })(); Security Iran-linked CyberAv3ngers suspected in attacks on Minnesota water systems More than 30 facilities disrupted in 'coordinated cyberattack,' though officials have yet to name a culprit Connor Jones Connor Jones Cybersecurity reporter Published wed 29 Jul 2026 // 14:49 UTC Security researchers at Tenable suspect the Iran-linked faux hacktivist outfit CyberAv3ngers was behind the cyberattack that disrupted more than 30 Minnesota water facilities.Neither state-level nor federal…
Excerpt limited to ~120 words for fair-use compliance. The full article is at The Register.
Discussion
0 commentsMore from The Register
