- Filed
- September 17, 2026, 21:00 UTC
- Actor
- CyberAv3ngers, an IRGC Cyber-Electronic Command affiliated persona also tracked as Bauxite, Mr. Soul, Hydro Kitten, and Shahid Kaveh Group; Rewards for Justice names Amir Yaryab as the CEC official who oversees the brand
- Target
- U.S. municipal operators, local newsrooms, and national audiences asked to treat opportunistic PLC lockouts as proof that the Iran war has already reached the kitchen tap
- Source
- Unidentified Source blurred: contractors, cutouts, buried disclosure
- Confidence
- high Multiple independent open sources, low disagreement about the facts
- Techniques
- Fear appealTransferCard stackingDisclosure theaterOverton window shifting
- Where
- United States, Iran, Pennsylvania, Minnesota
- Channels
- Internet-facing Unitronics, Rockwell, Schneider, and Siemens PLCs at water and wastewater plants
- CISA AA26-097A, 7 April 2026, updated 22 July 2026
- FBI-EPA public service announcement, 30 July 2026
- 2023 Aliquippa, Pennsylvania Unitronics HMI defacement
- Telegram and social accounts under CyberAv3ngers and Mr. Soul
- State Department Rewards for Justice bounty pages
- Kharon brief, 17 September 2026
- CSIS mapping note, 18 August 2026
Summary
On 17 September 2026 Kharon published Ian Talley's reconstruction of the 2026 U.S. water-system wave as information operations first: cheap lockouts of internet-facing PLCs that produce boil-water notices and fear while causing little lasting damage. CISA advisory AA26-097A, issued 7 April 2026 and updated 22 July, attributes ongoing PLC exploitation across water, energy, and municipal facilities to Iranian-affiliated actors and lists aliases including CyberAv3ngers, Mr. Soul, Bauxite, and Shahid Kaveh Group. The FBI and EPA PSA of 30 July recorded incidents since 27 July in at least seven states, some of which degraded operations. CSIS on 18 August mapped at least twelve states and cited a CyberAv3ngers line that the intent was to warn America to back down. Rewards for Justice lists a $10 million bounty on CyberAv3ngers and on Amir Yaryab as the IRGC-CEC official who oversees the brand. Score the advisories, the 2023 Aliquippa defacement, and the bounty pages as documented. Score a signed IRGC tasking order for the July Minnesota wave as not shown.
Analysis
The last two active briefs covered a Russian-speaking Politology coordinator feeding Radio Lengo Songo and a U.S.-registered institute moving a Hands Off Asia slogan. Rotation this cycle is Iran state-adjacent military cyber: not another NGO masthead and not another commercial X farm.
On 17 September 2026 Kharon published Talley's argument that the 2026 water-system wave looks less like a new terror front than like a standing psyop. That is a frame. The load-bearing records sit underneath it. CISA, FBI, NSA, EPA, DOE, and U.S. Cyber Command first warned on 7 April 2026, in advisory AA26-097A, that Iranian-affiliated actors were exploiting internet-connected PLCs across water, energy, and municipal facilities, causing operational disruption and financial loss in some cases. The 22 July update added Schneider Electric and Siemens gear to the Rockwell set and restated disruptive intent. CISA lists public aliases for the same cluster: Hydro Kitten, Storm-0784, APT Iran, Bauxite, Mr. Soul, Soldiers of Solomon, UNC5691, and Shahid Kaveh Group. The older joint advisory AA23-335A, 1 December 2023, already named CyberAv3ngers as an IRGC-affiliated persona and recorded the Aliquippa, Pennsylvania defacement: You have been hacked, down with Israel. Every equipment made in Israel is CyberAv3ngers legal target. On 30 July 2026 the FBI and EPA said water and wastewater utilities in at least seven states had reported incidents since 27 July, some of which degraded operations, with effects including loss of pressure and flooding. That PSA did not name Iran. CSIS on 18 August wrote that CyberAv3ngers had claimed the 2026 wave in order to warn America to back down, and that reporting had reached twelve states and about one hundred facilities with no documented collapse of drinking-water quality. Rewards for Justice still offers up to ten million dollars on the CyberAv3ngers brand and on Amir Yaryab, described as the IRGC-CEC official who oversees that brand. Score the sealed advisories, the Aliquippa sentence, the seven-state FBI count, and the bounty pages as documented. Score Talley's psyop headline and a finding that every July lockout was tasked from Tehran as assessments.
Mechanism is fear-appeal first. A cheap default-password PLC is the stage. A boil-water notice and a locked HMI are the catastrophe language. Transfer is the move from a municipal pump house to the war: the same screen that once carried down with Israel now carries the implication that the Iran fight is in the tap. Card-stacking is the missing denominator: one hundred facilities against roughly 148,000 U.S. public water systems, minor operational hits sold without that base rate. Disclosure-theater is the persona stack. CyberAv3ngers, Mr. Soul, and Bauxite travel as hacktivist names; the IRGC-CEC affiliation lives on CISA and Rewards for Justice pages that do not appear on the HMI. Overton-shift is the product of repetition: after three years of small lockouts, a homeland water war is discussable even when the physics stay modest.
This is propaganda on the method test where origin is an IRGC-affiliated cyber persona plus a command that U.S. pages name, form is a local utility outage plus a slogan on a screen, and the design goal is to move belief about the war's reach without a munition on U.S. soil. Gray color does not cancel the method. A same-method test applies in reverse. A U.S. or Israeli unit that locked Iranian municipal PLCs, sprayed a down with the IRGC banner, and let the outage do the messaging would be this brief with the capitals swapped. Exposed Unitronics and Rockwell boxes are a security fact. Using that fact as a billboard is the influence layer.
Literacy counter: keep three objects apart. One: AA26-097A and its 22 July update, the 30 July FBI-EPA seven-state count, the 2023 Aliquippa defacement sentence, and the two Rewards for Justice pages. Those are records. Two: Kharon's psyop headline and CSIS's warn-America sentence. Those are readings of the records. Three: the instruction that object one proves every U.S. water hiccup is Tehran, or that object two proves the lockouts were harmless pranks. If the payload is two or three, the stack is still doing method work. If the payload is one, open AA26-097A, the 30 July FBI PSA, and the CyberAv3ngers bounty page on the same screen.
Tells
- A cheap default-password PLC used as a billboard rather than as a destructive payload
- Hacktivist brand names on the HMI and IRGC-CEC names on the bounty page
- Boil-water and pressure-loss language offered without the 148,000-system denominator
- Telegram boasts of a coming detonation that does not arrive
- The same persona cluster reused from 2023 Unitronics defacements into 2026 Rockwell lockouts
Evidence
- Kharon, 17 September 2026: Talley on the U.S. water-system wave as psyop
- CISA AA26-097A, 7 April 2026, updated 22 July 2026: Iranian-affiliated PLC exploitation
- CISA AA23-335A: IRGC-affiliated CyberAv3ngers Unitronics defacement including Aliquippa
- FBI and EPA, 30 July 2026: water and wastewater incidents in at least seven states
- CSIS, 18 August 2026: mapping of the 2026 water-system campaign and claim language
- DomainTools, June 2026: nation-state targeting of water systems 2024-2026
- Rewards for Justice: CyberAv3ngers bounty page
- Rewards for Justice: Amir Yaryab bounty page naming CyberAv3ngers oversight
Related briefs
- Sep 17, 2026UnidentifiedThree Iranian propaganda offices used Claude as a staff shop to plan soft-war personas and paste IRGC lines onto Western think-tank letterhead.
- Sep 17, 2026UnidentifiedA Bangui radio desk used Claude to write pro-Moscow, anti-France copy for Radio Lengo Songo so an SVR-assessed Politology shop would sound like a local station.
- Sep 17, 2026UnidentifiedTricontinental and a Shanghai-based donor pipeline moved Hands Off Asia from an X slogan through a Beijing webinar and Colombo declaration into August U.S. anti-base rallies.