Iran-Linked Actors Breach Are Targeting US Water and Energy Control Systems

2026-07-26T08:51:42Z91372696a35668aeefedd41b8643fa8128e742347f0a10bc65e364d2659c7ba0
browser-based-c2chaos-ransomwarecheck-pointchrome-devtools-protocol (cdp)cisa-kevcritical-infrastructuredata-breachdd-wrtenergy-sectorespionagehades-implanthermes-aiiran-linkedlangflowlaundry-bearmsaratnotepad++-pluginorigin-energyphishingsharepointsupply-chainuac-0099water-systemswordpresszimbra

What happened

Multiple high-impact cyber developments: US agencies warn Iran-linked actors are actively compromising internet-exposed water and energy control systems and making changes that risk disruption; an alleged hacker claims data from ~2 million Origin Energy customers was stolen; researchers disclosed a live espionage operation against Thailand’s Ministry of Finance using a Hermes AI agent and Hades implant; UAC-0099 is delivering malware via a fake Notepad++ plugin in phishing campaigns; Russia-linked Laundry Bear is exploiting unpatched Zimbra servers; CISA added multiple products (including MS S

Why it matters

A reviewed impact interpretation has not been published for this record.

Evidence and limitations

Source ID
securityaffairs
Record identifier
91372696a35668aeefedd41b8643fa8128e742347f0a10bc65e364d2659c7ba0
Enrichment time
2026-07-26T08:51:42Z
AI-assisted enrichment
Yes

This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.