As if things with Iran weren't already complicated enough, there are indications that the Islamic Revolutionary Guard Corps (IRGC) is trying something new - in, of all places, Minnesota.
Yes, you read that right. And the possible intrusion here isn't coming from a bunch of AK-waving goons or explosive-strapped useful idiots. No, this is something more sophisticated: A cyberattack on Minnesota water systems that resulted in water to 30 Minnesota communities being shut down.
Between Sunday, July 26, and Monday, July 27, 2026, a coordinated cyber attack disrupted water and wastewater utility operations across more than 30 communities in Minnesota. Four cities publicly disclosed attacks: Braham, Plymouth, South St. Paul, and Maple Plain. Minnesota IT Services described the incident as a coordinated cyber attack targeting technology at community water systems across the state.
In Braham, a community of approximately 1,700 people, the attack disabled computerized operating controls and temporarily shut down the city's well and water treatment plant. Public works crews restored the plant within approximately two hours. In Plymouth (population approximately 80,000), the city's IT division disconnected cellular-connected equipment at two water towers and multiple wastewater lift stations to stop the attack and prevent retargeting while equipment was reconfigured. Crews continued operating through manual procedures. South St. Paul reported that some automated water utility controls were affected, while Maple Plain declared a local state of emergency to expand its response capabilities.
In all confirmed cases, officials said drinking water quality was not affected and no boil-water advisories were issued. The Minnesota Department of Health is working directly with targeted water systems to protect public health.
That could have been much worse. If one wanted to bring a modern city to its knees in a matter of days, weeks at the most, one way to do that would be to shut off the water.
Here's the onion:
Federal and state officials have not publicly attributed the Minnesota attacks to any specific actor. However, the operational pattern is consistent with the CyberAv3ngers threat ecosystem, a state-directed group the U.S. government has formally attributed to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command.
In February 2024, the U.S. Treasury Department sanctioned six IRGC-CEC officials for directing CyberAv3ngers operations, and the State Department offered up to $10 million for information on the group through the Rewards for Justice program. The group has been active since at least 2020; the security community tracks it under multiple designations, including Storm-0784 (Microsoft), Bauxite (Dragos), Hydro Kitten, UNC5691 (Mandiant), and MITRE ATT&CK group ID G1027. In April 2026, Tenable Research Special Operations published a comprehensive FAQ on CyberAv3ngers detailing the group's history, capabilities, and targeting profile.
As of this writing, the IRGC hasn't claimed credit for this cyberattack. But then, if they have enough brains to pound sand, and we shouldn't assume they are stupid (well, not all of them, anyway) they wouldn't claim credit even if they are responsible. No, if the IRGC is behind this, the smartest thing they could do is to keep on the sly about it, so they could do it again, and again, or possibly attack even more critical systems.
So, as of right now, the Minnesota authorities don't know who did this. There's just a digital fingerprint that happens to resemble one known to belong to the IRGC. That's troubling enough as it is, but if they are behind this, then that's another thing that, sooner or later, they will be called to account for.
Editor's Note: For decades, former presidents have been all talk and no action. Now, Donald Trump is eliminating the threat from Iran once and for all.
Help us report the truth about the Trump administration's decisive actions to keep Americans safe and bring peace to the world. Join RedState VIP and use promo code FIGHT to get 60% off your VIP membership.
Join the conversation as a VIP Member