Iranian hackers’ attacks on water systems in 12 U.S. states exposed serious weaknesses in America’s critical water infrastructure and showed how a broader campaign could trigger a nationwide public health crisis. The article argues that the U.S. must urgently strengthen defenses with zero-trust architecture, formal methods, and AI-enabled cybersecurity support for utilities of all sizes. #IranianHackers #WaterSystems #ZeroTrustArchitecture #VoltTyphoon #ClaudeMythos

an industrial cybersecurity firm read more about Iranian Hackers Maintain 2-Year Access to Middle East CNI via VPN Flaws and Malware

The Iranian cyberespionage group Charming Kitten is using fake webinars and a new 'BASICSTAR' backdoor to target experts in Middle Eastern policy.

Iranian cyber terrorists forced the unnamed facility to be completely closed down while staff battled to bring systems back online, in the first and most effective attack of its kind.

Authorities in Minnesota are investigating cyberattacks that hit more than 30 water systems, with officials not yet identifying the culprit. The incidents come as US agencies warn that Iranian hackers have been targeting water and wastewater systems and other critical infrastructure. #MinnesotaITServices #FBI #CISA #IranianHackers...

via NBC News Top Stories — The Trump administration is warning about potential cyberattacks after a senior law enforcement official told NBC News that a cyberattack on water systems in Minnesota had all the hallmarks of Iranian-backed hackers. NBC News’ Garrett Haake reports.

The Strategic Value of Silent Persistence Iranian threat actors operate with significantly greater stealth than conventionally perceived. Rather than executing immediate, high-profile disruptive attacks, these adversaries meticulously maintain long-term, covert access within compromised networks. They strategically leverage these embedded footholds for prolonged espionage, psychological pressure, or targeted sabotage when geopolitical conditions dictate. This sobering conclusion stems from a comprehensive analysis conducted by…

The Iranian state-sponsored threat actor known as Nimbus Manticore (aka Screening Serpens and UNC1549) has been attributed to a fresh campaign using lures impersonating organizations in the aviation and software sectors across the U.S., Europe, and the Middle East following the joint U.S.-Israeli military campaign against the country in late February 2026. The activity, besides embracing

 Ravin Academy, a cybersecurity training center closely linked to Iran's Ministry of Intelligence and Security (MOIS), has suffered a significant data breach that exposed the personal information of over 1,000 individuals enrolled in its technical programs. The academy, established in 2019, has been described as a recruitment pipeline for Iran's cyber operations and has previously been sanctioned by the U.S., UK, and EU for aiding the country's intelligence activities. Details of the breach The breach involved the compromise of personal data, including names, phone numbers, Telegram usernames, and, in some cases, national ID numbers of students and associates. The information was reportedly leaked on an online platform managed by the academy and subsequently made public by UK-based Iranian activist Nariman Gharib, who obtained a copy of the stolen dataset.  The breach occurred just before Ravin Academy's annual Tech Olympics event, leading the institution to claim the attack was orchestrated to undermine its reputation and harm Iran's cybersecurity ambitions. Ravin Academy has been widely recognized for providing both offensive and defensive cyber training to Iranian intelligence personnel, including courses in red-teaming, malware reverse-engineering, and vulnerability analysis.  The academy’s founders, Farzin Karimi Mazlganchai and Seyed Mojtaba Mostafavi, are themselves sanctioned by Western governments for their ties to state-sponsored cyber operations. The organization is thought to play a critical role in Iran’s cyber capabilities, contributing to projects that have targeted domestic protests and international adversaries. Global implications The breach not only highlights vulnerabilities within Iran’s cyber training infrastructure but also raises concerns over the privacy and security of individuals involved in state-linked cyber programs. Analysts suggest the incident underscores the risks faced by institutions central to national cyber development and the growing sophistication of cyber operations targeting such entities.  With the leaked data potentially useful for intelligence and counterintelligence purposes, the breach has significant ramifications for both individual privacy and the broader landscape of cyber conflict. This incident serves as a stark reminder of the exposure faced by state-affiliated cyber training programs and the far-reaching consequences of cyber breaches in the realm of international security.

The attacks are meant to cause disruption, according to federal agencies, but the specifics are still unclear.

Hackers breached FBI Director Kash Patel’s personal email, according to sources familiar with the situation.

Over 900 automatic tank gauge (ATG) systems in the United States are exposed online and vulnerable to attacks that can alter settings, disable alerts, and disrupt fuel or chemical storage monitoring. U.S. agencies including CISA, the FBI, and the NSA warn organizations to secure these systems after reports linked some incidents to Iranian hackers targeting internet-facing industrial controls. #CISA #FBI #NSA #Shadowserver #IranianHackers #AutomaticTankGauge