Iran International
Cyberattacks targeting water and wastewater facilities in at least seven US states appear to have been intended less to cripple infrastructure than to demonstrate Iranian reach, intimidate the public and shape perceptions, cybersecurity experts told Iran International.
"The psychological impact is what these attacks are intended to do,"said Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies (FDD).
"Iranian hackers in particular conduct what's called perception hacking," she said.
"They conduct a small-scale operation, they get into a network, they take a couple pictures of what they got, and then they claim to have caused a massive disruption because they're trying to cause a psychological impact even when they can't cause an actual true cyber impact."
Federal authorities last week warned that "malicious cyber actors" had targeted water and wastewater systems across at least seven states, with Minnesota reporting the largest number of incidents after around 30 water systems were disrupted. Officials urged utilities to disconnect vulnerable internet-connected equipment and switch to manual operations where necessary.
The FBI has opened an investigation but has not publicly attributed responsibility. However, multiple US media outlets, citing government officials familiar with the investigation, reported that Iran is the leading suspect.
President Donald Trump dismissed suggestions that Tehran was responsible, instead blaming Minnesota Governor Tim Walz, while Walz argued the attacks illustrated "what modern warfare looks like."
Why Iran?
Although no official attribution has been made, cybersecurity specialists say several characteristics of the campaign closely resemble previous Iranian operations.
"The particular systems they attacked are programmable logic controllers," Fixler said, referring to industrial control devices widely used in water facilities.
"The US government warned repeatedly earlier this year that Iranian actors were targeting those particular systems."
Earlier this year, the Cybersecurity and Infrastructure Security Agency (CISA) warned that Iranian-affiliated hackers were actively targeting internet-connected operational technology, including programmable logic controllers used in water infrastructure.
The agency later updated its advisory with additional guidance on securing vulnerable equipment.
Unlike financially motivated ransomware attacks, the latest incidents included no ransom demands.
"The first thing I look for is whether there's a ransom request," Fixler said. "We haven't seen that."
That absence points away from criminal hackers and toward a geopolitical operation, she said.
Amin Sabeti, a cybersecurity researcher specializing in Iranian cyber operations, said the campaign also reflects the typical strengths and limits of Iran's cyber capabilities.
"I don't think it was sophisticated, but it was a clever one," Sabeti said.
Rather than deploying cutting-edge exploits, he said the attackers appeared to exploit weak cybersecurity practices such as unchanged default passwords and poorly secured internet-connected equipment.
Compared with Russia and China, "they are a small boy in the town," Sabeti said, arguing Iranian operators excel at social engineering and exploiting simple vulnerabilities more than conducting highly sophisticated cyber campaigns.
A familiar playbook
The suspected campaign would fit a pattern established over recent years.
In late 2023, the IRGC-linked hacking group CyberAv3ngers targeted water facilities in Pennsylvania by compromising Israeli-made Unitronics programmable logic controllers, forcing operators to switch to manual controls.
Iran has also targeted Israeli water infrastructure. In 2020, Iranian hackers attempted to manipulate chlorine levels in Israeli water systems, according to Israeli and Western officials, prompting a reported Israeli cyber retaliation against Iran's Shahid Rajaee Port.
The same industrial control equipment targeted in previous Iranian operations has again become the focus of concern in the United States.
Fighting a war without missiles
Experts say the attacks fit neatly into Iran's broader doctrine of asymmetric warfare.
"They show that, for a big powerful country like America, they can still be reached. Iran can still touch them," security expert Roger Macmillan told Iran International.
"There is a huge psychological warfare piece... They can't attack us physically using missiles, but they can touch us digitally."
Macmillan said the campaign serves several purposes simultaneously: demonstrating that American critical infrastructure is vulnerable, gathering intelligence about similar systems across the country and reminding Washington that Tehran retains options beyond conventional military force.
"There's also an intelligence gathering piece," he said. "They will probe similar types of companies to see where the same weaknesses are and how they will exploit them."
As executions have accelerated in recent weeks, some Iranian social media users have increasingly portrayed the pre-dawn adhan as a reminder of hangings rather than the beginning of the day’s religious observances.
The adhan is the Islamic call summoning Muslims to the five daily prayers.
Iranian regulations state that death sentences should ordinarily be carried out at sunrise unless the court specifies another time. Executions are nevertheless widely associated with the early-morning hours, when prisoners’ families and supporters often wait for news as the dawn call to prayer is broadcast.
Social media anger turns toward religious symbols
Posts criticizing Islam and religious symbols circulated across Instagram and X following the latest executions.
An Instagram user wrote that the dawn adhan had become “a symbol and reminder of the execution of this country’s youth,” adding that a call intended to invite people to worship, peace and salvation had instead become associated with taking lives.
Activist Masih Alinejad wrote after clashes outside an execution site that the dawn call to prayer had become “only a symbol of death and execution.”
Another Instagram user wrote before planned executions in Isfahan that the young prisoners were due to be hanged “to the sound of the dawn call to prayer,” adding that it now carried “only the smell of death.”
Other users went further, posting profanity directed at Islam, the Quran, Shi’ite religious figures, the adhan and the Arbaeen pilgrimage. Some wrote that they no longer associated the dawn call with prayer but with executions.
IRGC-linked campaign urges crackdown
The IRGC-affiliated Fars News Agency said more than 700 people had signed a campaign on its platform by Tuesday, calling for the “maximum punishment” of those accused of “insulting Islamic sanctities online.”
Organizers cited Article 513 of Iran’s Islamic Penal Code and urged judicial and security authorities to take what they described as “effective and deterrent” action.
Under Article 513, insulting Islamic sanctities is punishable by between one and five years in prison. Cases classified as sabb al-nabi, or insulting the Prophet, can carry the death penalty.
Fars said campaign supporters called for tougher enforcement against people who “deliberately insult Islamic sanctities” online and urged authorities to prosecute offenders under existing legislation.
Judiciary spokesman Asghar Jahangir has previously said Iran continuously monitors cyberspace through a dedicated unit within the prosecutor general’s office and urged citizens to report alleged online offenses through official channels.
The campaign adds to broader efforts by Iranian authorities to tighten oversight of online speech as criticism over the recent executions continues to spread across social media.
The figures, presented at a public event hosted by the University of Tehran's Faculty of Urban Planning, offer the most detailed breakdown yet of damage across the capital following the conflict.
The report says District 4 in northeastern Tehran recorded the highest number of strikes, followed by District 21 in the west, District 1 in the north and District 22 in the northwest.
"The number of strikes in District 4 alone exceeded the combined total recorded in some provinces," Hossein Nouhi, a certified construction expert in Tehran's municipality, said during the event.
According to the report by Tehran Municipality's Urban Planning and Architecture Department, District 4 was hit 90 times, District 21 Tehran sustained 62 strikes, District 1 recorded 57 and District 22 recorded 55. District 17 in southwestern Tehran was the least affected, with three reported strikes.
Housing damage
The municipality said 50,849 residential units across Tehran sustained damage ranging from broken windows and doors to complete destruction.
Around 40,000 homes required minor repairs, about 8,900 suffered more extensive architectural damage, 415 buildings required structural reinforcement or reconstruction and 2,042 homes were completely destroyed and must be rebuilt, according to the report.
District 4 recorded the largest number of damaged residential units with 7,948, followed by District 2 with 4,037, District 15 with 3,490, District 11 with 3,432, District 21 with 3,205 and District 7 with 3,196.
The report also found that District 7 had the highest number of completely destroyed homes, with 429 units, followed by District 4 with 325 and District 11 with 248.
Estimated economic and environmental costs
Nouhi put the country's economic losses from the 40-day conflict at an estimated $280 billion, excluding psychological impacts and the cost of restoring industrial production. He argued that the conflict highlighted the need to require shelters in new high-rise developments.
Separately, geologist Mehdi Zare’ estimated that military strikes generated around 10 million metric tons of debris across affected urban areas by August 1. He said the waste includes concrete, steel, glass, asbestos and industrial pollutants that could create long-term environmental and public health risks.
Zare’ also said the demolition and cleanup process released millions of tons of greenhouse gases, adding to the environmental impact of the conflict.
