← threat actors
threat actor · IR
Cyber Av3ngers
also tracked as cyberav3ngers 2, apt iran 1, lapsus 1
2 stories · 1 in the wild · July 30, 2026 – September 10, 2026
evidence: 1 observed · 1 claimed
sectors
- critical infrastructure 2 · Sep 10
- transport 1 · Sep 10
- energy 1 · Jul 30
geography
- iran 2 · Sep 10
- united states 2 · Sep 10
- minnesota 1 · Jul 30
techniques
- communications disruption 1 · Jul 30
- ot attack 1 · Jul 30
what we reported, newest first, grouped by story
September 10, 2026
- LAPSUS$ posted a PGP-signed "Chapter II" message promising a first victim in three days (DarkWebInformer). Separately, APT IRAN, linked to IRGC-affiliated CyberAv3ngers, claimed the 7 September AT&T fiber outage across Houston, Dallas, Fort Worth and Austin plus an unnamed Texas water utility; AT&T says it has found no evidence the outage was an attack (DarkWebInformer).
· Sep 10 · claimed · as lapsus, apt iran, cyberav3ngers · Malware & Threat Activity
July 30, 2026
- Minnesota's coordinated OT attack now spans 30+ community water systems, with Iran-linked CyberAv3ngers the leading suspect (earlier coverage). Attacks on July 26–27 knocked Braham's water plant offline and caused communications and automated-control failures in Plymouth, South St. Paul and Maple Plain; the state activated its incident-response capabilities and the FBI is engaged. Drinking water reportedly remained safe as operators fell back to manual procedures. BleepingComputer, The Register
· Jul 30 · observed · as cyberav3ngers · Threat Activity