Skip to main content
TLP:GREEN  ·  Iran / Israel Conflict
Iranian Cyber Operations Hit U.S. Water Infrastructure:

What CISOs Must Do Now

CRITICAL. 165 days into the U.S.-Iran cyber conflict, Iranian state-sponsored units have moved from pre-positioning to active offensive operations against American critical infrastructure. IRGC-affiliated operators (HYDRO KITTEN/CyberAv3ngers) have caused physical water service outages across multiple U.S. states by manipulating PLCs at dozens of water treatment facilities — the largest confirmed Iranian ICS attack on U.S. soil. Fortinet has patched a fresh FortiWeb/FortiManager authentication bypass that Pioneer Kitten has historically weaponized within 48–72 hours, and TRACER KITTEN's telecom espionage campaign has resurfaced after months of silence.

I am a
My sector

DateDevelopmentSignificance
Aug 4, 2026CyberAv3ngers (IRGC-CEC) confirmed responsible for attacks on 36+ Minnesota water utilities and facilities in 6 additional statesLargest confirmed Iranian ICS attack on U.S. soil — physical outages achieved
Aug 11, 2026CVE-2026-20349 (Cisco ASA/FTD SSL VPN DoS) added to CISA Known Exploited Vulnerabilities catalogActive exploitation confirmed; unauthenticated remote device crash
Aug 11, 2026Fresh Cactus ransomware sample dropped on Iranian infrastructure (ASN 213790)MuddyWater/Cactus nexus continues daily infrastructure refresh — active campaign
Aug 12, 2026Pioneer Kitten (UNC757/Fox Kitten) actor profile updatedRenewed activity signals after Fortinet/Cisco exploitation history
Aug 13, 2026Fortinet patches FortiWeb and FortiManager authentication bypass flawsLogin with random credentials possible — Pioneer Kitten exploits Fortinet within days of disclosure historically
Aug 13, 2026TRACER KITTEN (Greenbug/MOIS) profile refreshed after months of silenceTelecom CDR espionage campaign with kinetic targeting implications

PhaseTimeframeCyber Activity
Conflict escalation beginsFeb 28, 2026U.S.-Iran kinetic conflict escalation begins; cyber retaliation cycle initiated.
New malware against Israeli targetsMar–Apr 2026HYDRO KITTEN (CyberAv3ngers) deploys ZodiacRAT and ScratchWiper against an Israeli engineering firm — new malware families confirmed.
U.S. water utility campaign beginsJul 26, 2026Coordinated cyberattacks begin against U.S. water facilities — PLC manipulation, service disruptions.
Physical outages confirmed & corroboratedAug 1–6, 2026Political attribution denial despite IC consensus (Aug 1); FBI/EPA joint alert confirms 36 Minnesota utilities compromised, physical water outages across 6+ states (Aug 4); CSIS publishes open-source corroboration of IRGC-CEC attribution (Aug 6).
Infrastructure refresh & VPN exploitationAug 10–13, 2026ASN 213790 (Tehran) infrastructure refreshed with new malware hash, healthcare/manufacturing targeting (Aug 10–12); CVE-2026-20349 added to CISA KEV, Cisco ASA/FTD actively exploited (Aug 11); Fortinet patches FortiWeb/FortiManager auth bypass, critical patch window opens (Aug 13).

This is the most operationally significant Iranian cyber unit currently active against U.S. targets. Tracked by CrowdStrike as HYDRO KITTEN, by Dragos as BAUXITE, and publicly known as CyberAv3ngers, this IRGC-CEC unit has compromised 36+ water utilities in Minnesota alone, with additional facilities in at least 6 other states, and manipulated PLCs (historically Unitronics Vision series, Allen-Bradley/Rockwell) to alter water treatment parameters.

The group has deployed new malware — ZodiacRAT (Go-based RAT with HTTP/HTTPS C2) and ScratchWiper (C++ destructive wiper) — and exploited 20+ CVEs including CVE-2024-41713, CVE-2024-47575, CVE-2025-0282, CVE-2024-53704, CVE-2024-55591, and CVE-2021-22681 (Rockwell PLC authentication bypass). Additional tooling includes IOControl (custom ICS backdoor) and Crucio (ransomware).

Critical escalation indicator: HYDRO KITTEN possesses confirmed wiper capability (ScratchWiper) but has so far limited U.S. operations to disruption rather than destruction. This restraint may not hold if kinetic escalation continues. Wiper deployment against U.S. critical infrastructure would represent a significant threshold crossing.

T0831T0836

Infrastructure on ASN 213790 ("Limited Network," Tehran) continues daily refresh cycles. This convergence of state-sponsored tooling and ransomware operations targets healthcare, manufacturing, and technology sectors. The operational model: MuddyWater provides initial access; Cactus ransomware operators monetize or destroy.

Key infrastructure nodes remain active as of August 12, 2026, with a fresh Cactus sample created August 11.

T1195.002T1059T1569.002

Updated August 12, this actor has a documented pattern of exploiting Fortinet and Cisco vulnerabilities within days of public disclosure. The August 13 Fortinet FortiWeb/FortiManager authentication bypass — which allows login with random usernames and passwords — falls squarely within Pioneer Kitten's exploitation playbook. Historical precedent: CVE-2024-55591 (Fortinet) and CVE-2024-53704 (SonicWall) were weaponized rapidly.

T1190T1078T1499.004

After months of silence, this MOIS-affiliated actor's profile was refreshed August 13, signaling renewed telecom Call Data Record (CDR) espionage operations. CDR collection has kinetic targeting implications — identifying the physical locations and communication patterns of military and intelligence personnel.

ScenarioProbabilityTimeframeIndicators to Watch
Continued water sector targeting in additional U.S. states>75% (HIGH)7 daysNew state-level utility outage reports; Unitronics/Rockwell PLC scanning
Fortinet FortiWeb/FortiManager auth bypass exploited by Iranian actors50–60% (MODERATE-HIGH)72 hoursAnomalous FortiWeb logins; FortiManager device impersonation
Cactus ransomware deployment against healthcare organizations via ASN 213790 infrastructure60–70% (MODERATE-HIGH)14 daysConnections to 77.90.185.x or 185.93.89.x ranges; Cactus TTP patterns
ScratchWiper destructive attack against U.S. critical infrastructure30–40% (LOW-MODERATE)30 daysScratchWiper or Crucio samples targeting non-Israeli infrastructure
CVE-2026-20349 exploitation by Iranian actors for VPN access denial>65% (MODERATE-HIGH)7 daysCisco ASA/FTD unexpected reloads; crafted HTTP to VPN portals
APT42 credential phishing campaign resurgence targeting policy makers40–50% (MODERATE)14 daysNICECURL/TAMECAT/AnvilEcho deployment; spear-phishing from spoofed think tanks

1. Iranian C2 Infrastructure Monitoring:

Hunt for any historical or active connections to confirmed Iranian C2 nodes. These IPs are associated with SystemBC (SOCKS5 proxy), DarkComet RAT, and Cactus ransomware operations: Query SIEM/NDR for connections to ASN 213790 ("Limited Network," Tehran) and ASN 214351 ("Femo IT Solutions") Alert on any beaconing patterns to the IOCs listed in the blocking table below

2. VPN Infrastructure Integrity:

Monitor Cisco ASA/FTD devices for unexpected reloads or crash dumps — indicator of CVE-2026-20349 exploitation Monitor FortiWeb for logins from unknown usernames; monitor FortiManager for unregistered FortiGate device connections

3. ICS/OT Anomaly Detection:

Alert on any internet-originating traffic to PLC management ports (TCP 502/Modbus, TCP 44818/EtherNet/IP, TCP 20256/Unitronics PCOM) Monitor for PLC logic changes outside maintenance windows Detect batch script execution or service creation on HMI/engineering workstations

4. Ransomware Pre-Cursor Activity:

Hunt for Cactus ransomware TTPs: command injection via web applications, service execution for payload deployment, non-standard port C2 Alert on new Windows services created via sc.exe or schtasks on servers with healthcare/manufacturing data

ThreatATT&CK
1. Iranian C2 Infrastructure MonitoringT1071.001 T1573 T1090.002 T1219
2. VPN Infrastructure IntegrityT1190 T1078 T1499.004
3. ICS/OT Anomaly DetectionT1190 T0831 T0836
4. Ransomware Pre-Cursor ActivityT1195.002 T1059 T1569.002
IOC Blocking Table:
192.253.248[.]6577.90.185[.]118185.93.89[.]4377.90.185[.]248176.123.87[.]16185.93.89[.]14762.60.226[.]10

Block the above at perimeter firewalls, proxies, and DNS. Hashes: 90b89a6dc4565c9817e7db8323702006860cb2b49f352863f2b18ba21c66b435, 6729c71328ce8498c26e6a46b7ba2fe84c611814d92703bdc2c1ebb7339d43fd, 0179ad14c9df5141b4479688d0135aa2132e1605dbd7852a2fac7ed543e53138, 70a779123b6faca3cec3fc8872717e55. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.

Hunting Hypotheses:
HUNT 01
Iranian pre-positioning via Cisco VPN
SSL VPN authentication failures followed by device reload within 60s
HUNT 02
Cactus ransomware staging
New service creation + outbound connection to 77.90.185.0/24 or 185.93.89.0/24
HUNT 03
ZodiacRAT beaconing
Go binary user-agent strings + periodic HTTP/HTTPS callbacks to non-CDN infrastructure
HUNT 04
FortiManager impersonation
Device registration from unrecognized serial numbers or IP ranges
HUNT 05
PLC reconnaissance
Modbus/EtherNet-IP scanning from IT network segments; PCOM protocol from non-engineering hosts

Financial Services
Banking, SWIFT/Wire Transfer Systems
Primary threat
MuddyWater/Cactus ransomware nexus targeting financial data for extortion; Pioneer Kitten initial access brokering.
Secondary threat
Key CVEs: CVE-2026-20349 (Cisco ASA/FTD); Fortinet FortiWeb/FortiManager auth bypass (patched Aug 13).
Actions
  • Audit all Fortinet and Cisco VPN appliances for patch currency
  • Implement conditional access policies that detect impossible-travel logins to treasury and wire transfer systems
  • Monitor for SystemBC SOCKS5 proxy traffic that could indicate lateral movement toward SWIFT or payment processing systems
Energy
Grid, SCADA/HMI
Primary threat
HYDRO KITTEN ICS/OT targeting — demonstrated capability against PLCs and SCADA systems; potential pivot from water to energy grid.
Secondary threat
Key CVE: CVE-2021-22681 (Rockwell PLC auth bypass — in HYDRO KITTEN's arsenal).
Actions
  • Segment all OT networks from IT with unidirectional gateways where possible
  • Audit ABB Zenon HMI installations per CISA ICS advisory
  • Verify no Rockwell/Allen-Bradley PLCs are internet-accessible
  • Implement OT-specific anomaly detection for Modbus/EtherNet-IP protocol deviations
Healthcare
EHR Systems, Patient Care
Primary threat
Cactus ransomware with confirmed healthcare targeting via ASN 213790 infrastructure; MuddyWater initial access leading to data encryption.
Secondary threat
All Cactus hashes and IPs in the blocking table explicitly tag healthcare.
Actions
  • Block all ASN 213790 IP ranges at the network edge
  • Ensure offline backups of EHR systems are current and tested
  • Deploy EDR rules for the Cactus hashes listed in the IOC blocking table
  • Conduct tabletop exercise for ransomware scenario affecting patient care systems
Government
Defense Industrial Base, Federal Networks
Primary threat
Pioneer Kitten VPN exploitation for persistent access; TRACER KITTEN CDR espionage for personnel targeting; APT42 credential harvesting against policy makers.
Secondary threat
Key actors: Pioneer Kitten (UNC757), TRACER KITTEN (Greenbug/MOIS), APT42 (Charming Kitten/IRGC-IO).
Actions
  • Emergency patch Cisco ASA/FTD (CVE-2026-20349) and Fortinet appliances
  • Implement phishing-resistant MFA (FIDO2) for all privileged accounts
  • Audit telecom provider security for CDR protection
  • Hunt for anomalous OAuth token grants in M365/Azure AD environments
Aviation / Logistics
CPDLC Systems, Supply Chain
Primary threat
CPDLC/ATN-B1 communication link vulnerabilities; supply chain compromise via compromised logistics software.
Secondary threat
Iranian actors have not yet demonstrated aviation-sector attacks in this conflict, but capability development is assessed as ongoing.
Actions
  • Assess exposure of Controller-Pilot Data Link Communications systems
  • Verify integrity of flight management system update chains
  • Monitor for anomalous ADS-B or ACARS traffic patterns
  • Ensure air-gapped backup navigation procedures are exercised
No sector cards match the selected filters.

Patch Cisco ASA/FTD against CVE-2026-20349 — actively exploited per CISA KEV. If patching requires a maintenance window, disable Remote Access SSL VPN service until patch is applied.
Incident Responder
Apply Fortinet FortiWeb and FortiManager patches released August 13. Authentication bypass allows login with random credentials. Pioneer Kitten has historically weaponized Fortinet flaws within 48–72 hours of disclosure.
Incident Responder
Block all 7 IPv4 IOCs listed in the blocking table at perimeter firewalls, proxy, and DNS sinkholes. Add to SIEM watchlist and run a 90-day retrospective query for any historical connections.
SOC Analyst
Deploy Cactus ransomware hashes (3 SHA-256 + 1 MD5) to EDR blocklists across all endpoints.
SOC Analyst
Approve an emergency patching window for Cisco and Fortinet appliances — business justification: active nation-state exploitation during wartime conditions.
CISO / Exec
No immediate actions for the selected roles.
Audit all internet-exposed PLCs and SCADA HMIs — specifically Unitronics Vision series, Allen-Bradley/Rockwell, and ABB Zenon. Remove default credentials. Implement IT/OT network segmentation per CISA guidance.
ICS / OT
Develop detection signatures for ZodiacRAT (Go binary, HTTP/HTTPS C2 beaconing, likely custom user-agent) and ScratchWiper (C++ disk wiper with batch script persistence mechanisms). Request IOCs from CrowdStrike Falcon X.
Threat Hunter
Implement ASN-level blocking for ASN 213790 ("Limited Network," Tehran) and ASN 214351 ("Femo IT Solutions") — these autonomous systems host confirmed Iranian state-sponsored C2 infrastructure.
SOC Analyst
Update incident response playbooks to include the Iranian wiper scenario. Pre-position forensic images and ensure OT-specific IR procedures exist for PLC recovery.
Incident Responder
Brief executive leadership on the current threat posture: nation-state actors are actively attacking U.S. critical infrastructure with confirmed physical impact. Ensure board-level awareness and crisis communication plans are current.
CISO / Exec
No 7-day actions for the selected roles.
Commission an OT/ICS security assessment for any water, wastewater, or energy SCADA systems under management. HYDRO KITTEN has hit 6+ states with a pattern suggesting continued geographic expansion. Coordinate with WaterISAC and E-ISAC.
CISO / Exec
Develop a proactive hunt playbook for cloud/OAuth weaponization — anomalous OAuth token grants, DigitalOcean API abuse, M365 calendar-based C2 patterns. Iranian actors may pivot to cloud vectors as perimeter defenses harden.
Threat Hunter
Implement phishing-resistant MFA (FIDO2/hardware keys) for all VPN, privileged access, and cloud admin accounts. Password-based and SMS-based MFA are insufficient against APT42's credential harvesting capabilities.
Incident Responder
Establish or strengthen ISAC relationships — WaterISAC, E-ISAC, H-ISAC, and Aviation ISAC. Sector-specific threat sharing is critical during sustained nation-state campaigns.
CISO / Exec
Conduct a tabletop exercise simulating a combined ransomware + wiper attack against primary business systems, with a parallel ICS manipulation scenario. Test decision-making under conditions where attribution is politically contested.
CISO / ExecIncident Responder
No 30-day actions for the selected roles.
The Bottom Line

We are 165 days into a sustained Iranian cyber offensive against U.S. and allied infrastructure. The IRGC has demonstrated both the capability and the intent to cause physical disruption to civilian services. The current operational pattern — PLC manipulation causing water outages without permanent physical destruction — represents a deliberate calibration of escalation. But the tools for destruction (ScratchWiper, Crucio) are built, tested, and deployed. The distance between "disruption" and "destruction" is a single command. Your Cisco ASA and Fortinet appliances need to be patched today. Your OT networks need to be audited this week. Your board needs to understand that this is not a hypothetical risk — it is an active military operation being conducted against civilian infrastructure.

1
The Fortinet authentication bypass disclosed today gives Iranian actors a fresh entry point into networks that may have hardened their Cisco exposure after the KEV announcement. The clock is ticking.
2
The MuddyWater/Cactus infrastructure refresh (new malware hash August 11, IPs active August 10–12) indicates an active campaign in execution — not preparation. Healthcare organizations are explicitly targeted.
3
Political attribution denial creates operational ambiguity that may reduce perceived consequences for Iranian operators, potentially accelerating tempo or escalation. Act accordingly.
No items found.