← threat actors
threat actor · not yet in the cluster map
iran-linked
3 stories · 3 in the wild · July 27, 2026 – August 24, 2026
evidence: 3 observed
sectors
- energy 3 · Aug 24
- critical infrastructure 2 · Aug 4
geography
- uk 1 · Aug 24
- us 1 · Aug 24
- united states 1 · Aug 4
- usa 1 · Jul 27
techniques
- disruptive attack 1 · Aug 24
- ot compromise 1 · Aug 4
attack phases seen
- Initial access 2 · Aug 4
- Impact 1 · Aug 24
what we reported, newest first, grouped by story
August 24, 2026
- Iran-linked hackers forced a UK power plant offline for four consecutive days last month, in what officials describe as the first successful attack of its kind on British energy infrastructure (The Telegraph). The government says the facility was a small-scale generator and the national grid was never at risk (Cyber Security News); Security Affairs places the incident alongside concurrent intrusions at US water utilities (Security Affairs). (discussion)
· Aug 24 · observed · Nation-State & Critical Infrastructure
August 4, 2026
- The Iran-linked water-sector campaign has spread to Georgia and Michigan. Officials now count OT compromises at water and wastewater utilities across at least seven US states, prompting expanded protective measures (The Register, SecurityWeek). Continues earlier coverage.
· Aug 4 · observed · Threat Activity
July 27, 2026
- Iran-linked actors are targeting US water and energy control systems in an espionage-focused campaign against critical-infrastructure operators (SecurityAffairs).
· Jul 27 · observed · Threat Activity