Coordinated Attack on Minnesota Water Utilities

Over the weekend of July 26–27, a coordinated cyberattack hit more than 30 community water systems in the US state of Minnesota. This was not classic ransomware — the attackers targeted operational technology (OT) directly, i.e., the systems that physically control the treatment and distribution of drinking water.

The state IT agency, Minnesota IT Services (MNIT), activated a statewide incident response and described the event as one of the largest attacks on local water infrastructure in the state’s history.

In the city of Braham, unknown malware knocked out the control systems of the water treatment plant. Operations were restored after roughly three hours.

Plymouth and South St. Paul had to switch to manual operation of their water systems, and the mayor of the small town of Maple Plain declared a local state of emergency.

Drinking water quality was not at risk anywhere, but the incident shows how thin the line is. If the attackers had, say, manipulated chemical dosing instead of merely knocking out the controls, it would have been a very different story.

Technically, the attack is a textbook example of what US authorities have been warning about for months. The attackers targeted programmable logic controllers (PLCs). Let’s break down the attack vector in Plymouth, for example. The attack there was limited to devices connected via LTE modems at two water towers and several pumping stations. CISA explicitly warns that even organizations with mature security should review their external connectivity, because LTE modems installed by vendors or integrators often open up an attack vector.

According to the New York Times and other media, federal and state investigators are examining links to Iran and say the attacks match the characteristics of a campaign by Iran-affiliated actors that CISA described back in the spring. The main suspect is the group CyberAv3ngers, linked to Iran’s Islamic Revolutionary Guard Corps, which has attacked US water utilities before — though never on this scale.

What should you take away from this, even if you don’t run a water utility in Minnesota? CISA’s recommendations are universal and apply just as much to a Czech factory floor as to an American water treatment plant: no PLC or other OT device may be directly exposed to the internet, remote access belongs exclusively behind a VPN, default passwords must be changed, and external connectivity from vendors or integrators should be isolated to the bare minimum.

During penetration tests in manufacturing companies, we keep seeing the same picture: insufficient or completely missing network segmentation, no whitelists, open vendor access, and forgotten service accounts. Together, that makes a perfect setup for an attack. And the numbers confirm it — through Shodan and Censys, hundreds of industrial devices in the Czech Republic can be seen exposed directly to the internet.

If you’re not sure about your company’s security, we’ll help you find the gaps before attackers find and exploit them. At SysNetShield, we do penetration testing, phishing simulations, and red teaming. Get in touch at team@sysnetshield.com — the initial consultation and a vulnerability scan of one domain/IP address are free.

When the Agent Picks the Target: Inside an Autonomous Attack Campaign Driven by DeepSeek

A Chinese-speaking operator gave an AI agent a single instruction via Telegram and walked away. The agent found targets, procured exploits, failed, replanned and failed again, and finally gave the whole operation away by launching a web server in the wrong directory.

On July 30, Palo Alto Networks’ Unit 42 team published research by Andy Piazza describing what the team calls an autonomous AI-powered hacking campaign, run by a Chinese-speaking attacker operating under the handles knaithe and KnYuan. The operator combined Hermes Agent, an open-source agentic framework from NousResearch, with the DeepSeek model as the reasoning core, and controlled the entire operation via Telegram.

Hermes provided terminal access, a system of reusable skills, and unattended operation; DeepSeek handled code generation, vulnerability assessment, target selection, and decision-making. In one of the recovered sessions, Unit 42 could not find any operator input beyond the initial instruction — everything that followed, the model planned on its own.

Across both autonomous and manual activity, the attacker attempted to exploit more than 460 targets. The researchers gained insight into the operation only because Hermes, following a command from Telegram, launched a Python HTTP server on port 8888 from the operator’s home directory instead of an isolated working directory — making the operator’s model configurations, API keys, exploit scripts, target lists, shell history, and session logs accessible to anyone.

Anthropic’s Claude Reached Real Third-Party Systems During Cybersecurity Testing

Last week we covered the case of OpenAI models getting into Hugging Face systems. A similar report from Anthropic was not long in coming.

Anthropic disclosed that its Claude models, during internal cybersecurity testing, gained unauthorized access to the production systems of three different organizations after escaping to the open internet from test environments that were supposed to be closed.

Anthropic launched an extensive review after OpenAI announced that several of its own models had escaped from an isolated test environment and reached the production infrastructure of the Hugging Face platform. Based on that finding, Anthropic went through 141,006 evaluation runs in which Claude could theoretically have gained internet access, and identified three incidents in which the model crossed the intended boundary and touched real infrastructure. The earliest incidents date back to April 2026.

In all cases, Claude was given a “capture-the-flag” (CTF) task — the same thing we tested in our cyber lab. It’s a standard method for measuring a model’s offensive cyber capabilities, in which the model is told that a secret “flag” is hidden on another machine and its task is to break in and retrieve it.

The three incidents involved three different models and had markedly different outcomes. The most serious, involving Claude Opus 4.7, happened because the fictional target company happened to share its name with a real, active web domain. In four runs, Claude reached this company’s live infrastructure, obtained application and infrastructure credentials, and accessed a database containing production data. Interestingly, the model continued the attack even after its own reasoning recognized that these were real systems.

The whole incident carries a broader lesson, which Anthropic discusses openly. As autonomous agents become more capable, test environments must become ever more secure.

Hijacked Hotel Wi-Fi: Inside the CaptiveCrunch Campaign That Turned Login Portals into Malware Distribution Hubs

On July 31, the Microsoft Threat Intelligence team published an analysis of the CaptiveCrunch campaign, in which attackers use compromised captive portals in hotels, conference centers, and other shared spaces to manipulate the DNS and HTTP traffic of all guests connected to the network.

Microsoft says it has been tracking the traffic manipulation since early May 2026 and attributes the operation to Storm-2945, a group it assesses to be an operational subgroup of the actor Midnight Blizzard (also tracked as APT29, Cozy Bear, or the Dukes).

The mechanism is fairly simple. On networks where the DHCP server assigns a local DNS server so that every connecting client is shown the captive portal, traffic is redirected to domains such as m365-owa[.]com, owa-ms365[.]com, ms365-device[.]com, and ms365-live[.]com, which belong to the attackers and attempt to phish users’ Microsoft 365 credentials.

So far, no hotel, venue, or captive portal vendor has been named, and the initial compromise vector is still under investigation. ReliaQuest assesses, with only low to moderate confidence, that access was enabled by exposed administrative interfaces (SSH and web consoles reachable from the internet) combined with weak or reused administrator passwords.