Iran-Linked Actors Breach Are Targeting US Water and Energy Control Systems
2026-07-25T20:51:48Z•77b68ad988913aa13ee05fbe7410e5cd918e01309c628fe5319c1cc20bfac607
AI-securityCISAChaos-ransomwareCheck-PointDigital-Markets-ActGemini-3.5GoogleHadesHermes-AI-agentIran-linkedKEVLaundry BearOrigin-EnergySharePointUAC-0099Zimbrabrowser-based-C2critical-infrastructuredata-breachenergymsaRATnation-statephishingwater
What happened
Multiple high‑impact cyber incidents and advisories were reported: U.S. agencies (CISA, FBI, NSA, DoE) warned Iran‑linked actors have accessed and altered internet‑exposed water and energy control systems; Laundry Bear (Russia‑linked) is exploiting an unpatched Zimbra flaw to steal mail accounts; Chaos ransomware operators deployed a new browser‑based RAT (msaRAT) routing C2 through Chrome/Edge; Thailand’s Finance Ministry was compromised using a Hermes AI agent with a staged Hades implant; UAC‑0099 is delivering malware via a fake Notepad++ plugin with an analysis‑resistant loader; Australian
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 77b68ad988913aa13ee05fbe7410e5cd918e01309c628fe5319c1cc20bfac607
- Enrichment time
- 2026-07-25T20:51:48Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.