100+ Water Utilities Compromised Across 12 States

The IRGC Cyber-Electronic Command's operational arm has compromised water utilities across Minnesota (36 utilities), Georgia (300,000 customers affected), Utah, and at least 9 additional states. The attack methodology exploits default credentials on Unitronics Vision Series PLCs and internet-exposed PLC web interfaces to modify programmable logic — causing physical pressure drops and service outages.

This is no longer a cyber incident. It is a kinetic-adjacent operation causing physical-world consequences to civilian infrastructure during armed conflict.

Key TTPs: exploitation of public-facing applications, abuse of valid/default accounts, stored data manipulation of PLC logic, endpoint denial of service.

Clop ransomware has exploited a critical deserialization vulnerability (CVSS 9.8) in PTC Windchill PDMLink and FlexPLM — product lifecycle management software used extensively by defense contractors. Forty-three organizations breached, with Shell (89GB), General Electric, and Philips confirmed as victims. Attackers deployed JSP webshells for persistence and operated with a two-month dwell time before data appeared on leak sites.

Why this matters for the Iran conflict: Pioneer Kitten (IRGC-affiliated) has a documented history of monetizing initial access through ransomware partnerships. Criminal exploitation of DIB supply chains creates a direct pipeline: Clop breaches the network → Pioneer Kitten purchases or inherits access → state espionage of export-controlled weapons data.

The Ray distributed computing framework — widely used for defense AI/ML workloads — contains a browser-based RCE vulnerability exploitable via DNS rebinding. The RondoDox botnet incorporated this exploit two days before public disclosure, and the ShadowRay 2.0 campaign is actively targeting unpatched instances with NVIDIA GPUs.

Current exploitation is criminal (cryptomining/DDoS), but the vulnerability provides a template for state actors to compromise AI training clusters in government and DIB environments. CISA's FCEB remediation deadline is 20 August 2026.

Three concurrent absences define the most concerning signal this cycle: MuddyWater (MOIS-affiliated) — 6-day operational silence during active conflict, unusual for an actor that typically operates on 3–5 day cycles, with historical pattern showing silence → infrastructure refresh → new campaign wave; hacktivist IO groups (Handala, Cyber Toufan) — no Telegram activity, no data leaks, no wiper deployments, with silence duration approaching the historical maximum observed before major coordinated dumps; and wiper deployments — no BiBiWiper, ZeroShred, or GoneXML activity detected, unusual during kinetic conflict.

When multiple Iranian actor categories go simultaneously quiet during active hostilities, it historically signals coordinated retooling or preparation for a synchronized operation. This same pattern preceded the conflict's initiation.

A novel npm supply-chain worm dubbed ChainDrop (Shai-Hulud variant) has infected 444 packages with approximately 2 billion monthly downloads. Its key innovation: payloads are embedded in published tarballs without appearing in commit histories, and persistent hooks are planted in editor and AI agent configuration files. Simply checking out a compromised branch executes adversary code — no npm install required.

This bypasses all standard code-review defenses and represents a new class of supply-chain attack directly relevant to DIB software development pipelines.