Iran-Linked Actors Breach Are Targeting US Water and Energy Control Systems
2026-07-26T08:51:42Z•91372696a35668aeefedd41b8643fa8128e742347f0a10bc65e364d2659c7ba0
browser-based-c2chaos-ransomwarecheck-pointchrome-devtools-protocol (cdp)cisa-kevcritical-infrastructuredata-breachdd-wrtenergy-sectorespionagehades-implanthermes-aiiran-linkedlangflowlaundry-bearmsaratnotepad++-pluginorigin-energyphishingsharepointsupply-chainuac-0099water-systemswordpresszimbra
What happened
Multiple high-impact cyber developments: US agencies warn Iran-linked actors are actively compromising internet-exposed water and energy control systems and making changes that risk disruption; an alleged hacker claims data from ~2 million Origin Energy customers was stolen; researchers disclosed a live espionage operation against Thailand’s Ministry of Finance using a Hermes AI agent and Hades implant; UAC-0099 is delivering malware via a fake Notepad++ plugin in phishing campaigns; Russia-linked Laundry Bear is exploiting unpatched Zimbra servers; CISA added multiple products (including MS S
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 91372696a35668aeefedd41b8643fa8128e742347f0a10bc65e364d2659c7ba0
- Enrichment time
- 2026-07-26T08:51:42Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.