"The psychological impact is what these attacks are intended to do,"said Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies (FDD).
"Iranian hackers in particular conduct what's called perception hacking," she said.
"They conduct a small-scale operation, they get into a network, they take a couple pictures of what they got, and then they claim to have caused a massive disruption because they're trying to cause a psychological impact even when they can't cause an actual true cyber impact."
Federal authorities last week warned that "malicious cyber actors" had targeted water and wastewater systems across at least seven states, with Minnesota reporting the largest number of incidents after around 30 water systems were disrupted. Officials urged utilities to disconnect vulnerable internet-connected equipment and switch to manual operations where necessary.
The FBI has opened an investigation but has not publicly attributed responsibility. However, multiple US media outlets, citing government officials familiar with the investigation, reported that Iran is the leading suspect.
President Donald Trump dismissed suggestions that Tehran was responsible, instead blaming Minnesota Governor Tim Walz, while Walz argued the attacks illustrated "what modern warfare looks like."
Why Iran?
Although no official attribution has been made, cybersecurity specialists say several characteristics of the campaign closely resemble previous Iranian operations.
"The particular systems they attacked are programmable logic controllers," Fixler said, referring to industrial control devices widely used in water facilities.
"The US government warned repeatedly earlier this year that Iranian actors were targeting those particular systems."
Earlier this year, the Cybersecurity and Infrastructure Security Agency (CISA) warned that Iranian-affiliated hackers were actively targeting internet-connected operational technology, including programmable logic controllers used in water infrastructure.
The agency later updated its advisory with additional guidance on securing vulnerable equipment.
Unlike financially motivated ransomware attacks, the latest incidents included no ransom demands.
"The first thing I look for is whether there's a ransom request," Fixler said. "We haven't seen that."
That absence points away from criminal hackers and toward a geopolitical operation, she said.
Amin Sabeti, a cybersecurity researcher specializing in Iranian cyber operations, said the campaign also reflects the typical strengths and limits of Iran's cyber capabilities.
"I don't think it was sophisticated, but it was a clever one," Sabeti said.
Rather than deploying cutting-edge exploits, he said the attackers appeared to exploit weak cybersecurity practices such as unchanged default passwords and poorly secured internet-connected equipment.
Compared with Russia and China, "they are a small boy in the town," Sabeti said, arguing Iranian operators excel at social engineering and exploiting simple vulnerabilities more than conducting highly sophisticated cyber campaigns.
A familiar playbook
The suspected campaign would fit a pattern established over recent years.
In late 2023, the IRGC-linked hacking group CyberAv3ngers targeted water facilities in Pennsylvania by compromising Israeli-made Unitronics programmable logic controllers, forcing operators to switch to manual controls.
Iran has also targeted Israeli water infrastructure. In 2020, Iranian hackers attempted to manipulate chlorine levels in Israeli water systems, according to Israeli and Western officials, prompting a reported Israeli cyber retaliation against Iran's Shahid Rajaee Port.
The same industrial control equipment targeted in previous Iranian operations has again become the focus of concern in the United States.
Fighting a war without missiles
Experts say the attacks fit neatly into Iran's broader doctrine of asymmetric warfare.
"They show that, for a big powerful country like America, they can still be reached. Iran can still touch them," security expert Roger Macmillan told Iran International.
"There is a huge psychological warfare piece... They can't attack us physically using missiles, but they can touch us digitally."
Macmillan said the campaign serves several purposes simultaneously: demonstrating that American critical infrastructure is vulnerable, gathering intelligence about similar systems across the country and reminding Washington that Tehran retains options beyond conventional military force.
"There's also an intelligence gathering piece," he said. "They will probe similar types of companies to see where the same weaknesses are and how they will exploit them."