IRGC-linked hackers take UK power plant offline for four days; Treasury sanctions six MOIS operators

Iran-linked CyberAv3ngers took a UK power plant offline for four days and hit water utilities in 12 U.S. states. Treasury sanctioned six MOIS-linked individuals.

Overview

In late August 2026, multi-source public reporting showed IRGC-linked group CyberAv3ngers ran a dual-track attack on Western critical infrastructure: a UK power plant was compromised and stayed down for four days, while municipal water and wastewater systems in at least 12 U.S. states were hit in parallel. The incident led The Daily Telegraph, Axios, and The Record. Industry consensus: first demonstrated Iranian capability to inflict real physical impact on UK energy infrastructure. On 25 August, U.S. Treasury sanctioned six individuals linked to Iran's Ministry of Intelligence and Security (MOIS).

Incident timeline

UK power plant offline four days

The Daily Telegraph: target was a smaller gas-fired unit that still covers peak load. After the breach, attackers obtained control-system access and took the unit fully offline for four days. NCSC refused specifics, citing security, and described the site as small enough not to affect UK-wide supply. UK government issued emergency hardening guidance: all power companies must upgrade cyber defenses and reassess OT isolation.

Coordinated U.S. water-system intrusions

Same window: water and wastewater systems in at least 12 U.S. states. First public case — 30-plus municipal water systems in Minnesota: attackers remotely changed operator passwords and disabled alarms, leaving operators deaf and blind. A Georgia pump station failed; local pressure dropped; authorities issued a boil-water notice to 300,000 users. CISA, EPA, and USDA jointly warned attackers had control of some facilities — theoretically enough for sewage backflow, pipe bursts, and other high-severity public-safety events.

Treasury sanctions six; AI-assisted ICS malware

On 25 August, Treasury sanctioned six MOIS-linked individuals for cyber operations since 2023 against energy, defense, healthcare, finance, and government. CyberAv3ngers has started using ChatGPT and other generative AI to build malware against industrial control devices — a pattern multiple agencies flagged through H2 2025. Sanctions are diplomatic leverage; they do not shrink the current water-utility attack surface.

Attack characteristics and technical analysis

• AI-augmented kill chain: Axios and multiple research shops confirmed LLMs now assist custom attack scripts against PLC, SCADA, and HMI, cutting the traditional months-long ICS learning curve

• Lateral movement and persistence: operator passwords rewritten, alarms killed. Dual squeeze — seize control and cut the response path — creating a double-blind window inside SOP-driven IR

• Geographic coordination: UK and U.S. timing tightly synchronized; attacker profiles overlap. Consensus: two phases of one operational sequence

• OT exposure: water utilities are mostly local-government run, often without a dedicated CISO. Volunteer defense coverage is 21 sites versus 50,000+ small water facilities

• TTPs unpublished: exact paths, initial access, and malware families against the plant and water systems are not fully disclosed. Watch OT/ICS vendor and CISA follow-ups

Impact assessment

CVSS does not apply. Nation-state coordinated attack; score on strategic impact:

• Physical effect: four-day UK plant outage means attackers held substantive control of ICS components — not classic espionage dwell

• Public-service shock: U.S. water intrusions spanned multiple states; hundreds of thousands may change daily habits. Secondary risk to public health and trust

• Policy spillover: may accelerate U.S. EPA restart of water-sector cyber baseline rules after a prior rollback, and push UK/EU mandatory OT protection

• Demonstration effect: warning to developing states that depend on Western infrastructure. OT security is the floor for basic public services, not an optional extra

Remediation and defense

• OT segmentation: one-way gateways, data diodes, or physical isolation between IT and OT. No OT device on the internet. No unaudited cross-segment OT traffic

• Remote-access governance: collapse remote maintenance onto ZTNA. MFA, device posture, shortest sessions, full recording. Disable built-in credentials in TeamViewer, AnyDesk, and similar

• Credential rotation and least privilege: force periodic OT operator password rotation, kill default passwords, local accounts independent of IT domain, four-eyes

• Alarm and telemetry redundancy: vendor-independent uplink — SMS, separate cellular, other out-of-band paths — so killing one alarm channel does not black out ops state

• AI tool audit: whitelist generative-AI use for internal R&D, ops, and IR. Never submit production data or SCADA/ICS commands to external LLM services

• Intel subscriptions: water and power operators must subscribe to CISA, NCSC, ENISA ICS advisories and run 7×24 bidirectional alerting with ISACs

• Tabletop drills: quarterly ICS-compromise tabletop. Ops must complete degradation and on-site failover within 30 minutes of SCADA loss. Avoid the can't-see, can't-act double-blind

• Third-party governance: strict SLA and audit on remote-ops contractors; require MDR and regular SOC reports

Sources

• Axios: AI is amplifying cyberattacks on everyday utilities

• CyberSecBrief 25 August briefing

• Enigma Global 25 August threat-intel daily

• The Record: U.S. Treasury sanctions six Iranian MOIS operators