Seven States, Zero Hashes: The Water Attacks That Broke Attribution

Seven states. Water systems. One suspected nation-state actor. The headline was clean. The technical record was not. In May 2026, news broke that coordinated cyberattacks had struck water infrastructure in seven US states. Iran was named as the suspected perpetrator within hours. Not after forensic analysis. Not after a week of incident-response triage. Within hours. The story came from Crypto Briefing, a media outlet that primarily covers digital assets, not industrial control systems. I went looking for the evidence. Indicators of compromise. Malware hashes. Command-and-control domains. Exploited vulnerabilities. Intrusion timestamps. Verified impact assessments. The published attribution chain. I found silence. Let me be blunt about what that means. I have spent twenty-seven years conducting forensic analysis of failure — cryptographic failure, consensus failure, smart-contract failure, and now, infrastructure failure. I passed up a private bounty in 2017 when I uncovered an edge-case vulnerability in Tezos's proof-of-stake mechanism, choosing instead to publish a 40-page technical paper that exposed the exploit vector with mathematical rigor. I reconstructed the timeline of the UST de-peg in 2022 — the algorithmic stablecoin that vaporized forty billion dollars in a week — in a report that regulators later used as a primary reference. I know the difference between a conclusion and a case file. This report has a conclusion. It does not have a case. Pics are noise; the hash is the identity. And in this story, there is no hash. The sector under attack is not exotic. The United States operates roughly fifty thousand community water systems. The overwhelming majority are small operations — municipal departments or private utilities serving a few thousand residents. They run on tight budgets with maintenance backlogs and aging assets. Their industrial control systems — the ICS/SCADA networks that govern pumps, valves, chemical feeds, and pressure — were designed in an era before email, let alone state-sponsored malware. This exposure is not classified. CISA and the EPA have issued warnings for years. In 2021, an attacker reached the water treatment plant in Oldsmar, Florida, and briefly changed the sodium hydroxide concentration to a level that would have been toxic. The operator caught it in real time. The point was made: the controls are reachable. Then came CyberAv3ngers. From late 2023 through 2024, a group assessed by US and Israeli intelligence to be affiliated with Iran's Islamic Revolutionary Guard Corps systematically targeted Israeli-made Unitronics PLCs — programmable logic controllers widely deployed across American water systems. The method was crude: scan the internet for exposed devices, log in with default credentials, and alter system settings. In Aliquippa, Pennsylvania, they hijacked a pump station. Across multiple municipalities, they left their marks. The new attacks widen the pattern. Seven states, simultaneous, coordinated. This is no longer opportunistic scanning. This is deliberate targeting. Every forensic investigation begins with a single question: what does the data say? For the seven-state water attacks, the public data says almost nothing. No malware samples released. No hashes. No C2 domains. No MITRE ATT&CK technique identifiers. No intrusion timeline. No verification of what was reached. No confirmation of whether water service was actually disrupted. This is not how credible attribution works. Proper attribution is a forensic chain of custody. It begins with artifacts — binaries, logs, packet captures. The analyst extracts unique markers: compiler quirks, encryption implementation choices, code-reuse patterns. Infrastructure is traced through domain registrations, hosting providers, certificate transparency logs, and VPN services. Operational patterns are correlated: timestamps aligned with work shifts, activity in specific time zones, overlap with previously attributed campaigns. Tradecraft is mapped: tool sequencing, lateral movement, privilege escalation paths. Each step produces a confidence level. A credible report assigns probabilities. It does not issue verdicts. None of that exists in the public record for this attack. The word "suspected" is doing the work of forty pages of technical proof. Silence in the code speaks louder than the pitch. Let me now talk about the infrastructure itself, because the structural failure runs deeper than any single intrusion. The water sector has a design problem that mirrors the smart-contract vulnerabilities I have spent my career dissecting. In DeFi, we call it the oracle problem. A smart contract is a deterministic engine that trusts external data feeds. When an attacker manipulates the price oracle, the contract executes against a false reality — and the losses cascade before anyone notices. I audited protocols in 2020 and 2021 where a single manipulated price feed drained a treasury that had been marketed as secure. An ICS/SCADA system is an oracle problem at industrial scale. Sensors feed physical measurements into controllers. Controllers make decisions based on those measurements. Actuators execute the decisions. When an attacker alters the measurement — a pressure reading, a flow rate, a chemical concentration — the system responds to a reality that does not exist. Operators watch gauges that are lying. The physical world diverges from the digital representation of it. The Yearn.finance analysis I published in 2020 — "The Illusion of Infinite Yield" — documented how reported APYs concealed unpriced risk. Retail investors saw passive income; they were actually subsidizing protocol risk through their exposure. The UST de-peg in 2022 was the same disease at systemic scale: a mechanism that trusted a false assumption until the market revealed it. Water utilities are running the identical playbook. Security investment is deferred because the cost is visible today while the benefit is invisible. No one photographs an attack that didn't happen. Meanwhile, the risk compounds quietly, maturing into a catastrophe that arrives as an invoice. Every bug is a footprint left in haste. The water infrastructure has footprints dating back to the original deployment of the PLCs. Let me pull at one thread: the Unitronics exposure. Unitronics PLCs are Israeli-designed controllers built for a market where "security" meant a locked panel door, not network authentication. These devices expose a web interface for configuration. Standard configurations ship with admin credentials that operators rarely change. In dozens of documented cases across the United States, these devices were connected directly to the internet — often to avoid the cost of deploying secure remote-access infrastructure. An attacker does not need a zero-day to breach these systems. The attacker needs Shodan — a search engine for internet-connected devices — and a working default-credential list. The effort required to exploit these systems versus the effort required to defend them is grotesquely asymmetric. Attackers can launch campaigns across the entire sector for hundreds of thousands of dollars. Defenders would need billions — across fifty thousand utilities — to bring security to a professional standard. The ratio is approximately one to one hundred, and in many small utilities, the gap is far wider. This asymmetry is itself a vulnerability. It creates a permanent incentive for attackers to return, precisely because each attempt is so cheap. In the crypto world, we call it dusting — flooding a network with negligible transactions to sift for targets or break privacy. The water sector is being dusted by nation-states. In 2021, I demonstrated that eighty percent of Bored Ape Yacht Club's market value was tied to off-chain metadata hosted on a centralized server. The NFTs were claims; the actual data was elsewhere and could be altered or lost. The market did not care until it did. When I published that technical post-mortem on the fragility of digital ownership, the reaction was confusion from enthusiasts and engagement from institutional readers who understood infrastructure risk. Water systems have the same structural disease, with a deadlier substrate. The water is the asset. The control system is the metadata. If the control system lies, the asset itself becomes dangerous. The token holders — in this case, the residents of seven states — have no way to verify the state of the system. They depend on intermediaries whose only promise is that everything is under control. Let me now make the argument concrete about what is missing from the response. A comprehensive assessment of this attack would include: the initial access vector, whether phishing, an exposed service, or a supply-chain compromise; the tools used, from living-off-the-land binaries to custom malware; the persistence mechanisms, scheduled tasks, registry keys, or ICS-specific watchdog timers; the lateral movement path, from initial compromise to control network; the impact verification, whether any physical process state was changed; and the data-exfiltration assessment, whether environmental data was stolen for future targeting. Each of these would yield indicators: file hashes, YARA rules, IP addresses, domain names, registry artifacts. Without them, the public cannot evaluate even the fundamental question: did the attackers reach the control network, or were they contained at the enterprise layer? Did they manipulate a control loop, or did they only get as far as a weakly protected remote-access gateway before being locked out? The distinction is not academic. It determines the entire response. If the attackers achieved impact, immediate operational changes are warranted — unplugging exposed PLCs, changing all credentials, rebuilding network segmentation. If this was reconnaissance, it is a warning — but still one that demands basic hygiene. The fact that public reporting cannot answer these questions is precisely the failure I am documenting. The outlet that broke the story is a crypto publication, not an incident-response team. It should have said, "We do not know yet." Instead, it offered a suspect. I want to acknowledge the challenges for a moment. Attribution takes time. Technical investigation is slow, methodical, and often classified. Governments have legitimate reasons to withhold indicators from the public during an active investigation. I have worked with regulators under confidentiality constraints; I respect the tension between transparency and operational security. But there is a difference between withholding evidence during an active investigation and constructing a public narrative without evidence. The former is security. The latter is a liability. When a headline names Iran as the suspected author of an attack on American water, it shapes policy. Congress allocates budgets based on perceived threats. Intelligence agencies adjust their collections priorities. The public forms a worldview through repetition. My 2025 work on an on-chain surveillance framework — developed with three colleagues to track illicit flows across twelve blockchains while preserving privacy under EU MiCA regulations — was built on a single principle: evidence before action, provenance before punishment. We presented that framework to Taipei's financial authorities. The technology is different, but the discipline is the same. You do not indict a codebase without reproducing the exploit. You do not freeze a wallet without tracing the transaction path. You do not name a state actor without artifacts. The map is not the territory; the chain is both. In a distributed ledger, the history is the source of truth. In the water sector, there is no equivalent chain of custody — only scattered logs on devices never designed to preserve them. History is not written; it is indexed. Without an index of what actually happened in seven states, there is no history — only headlines. Now let me steelman the Iran attribution. This is where I depart from reflexive skepticism. First, precedent. CyberAv3ngers was assessed with meaningful confidence to be affiliated with Iran's Islamic Revolutionary Guard Corps. Their 2023-2024 campaigns against US water utilities are documented. They targeted Unitronics PLCs using default credentials and public exploits. If the new attacks deploy the same tools and infrastructure, attribution confidence rises substantially. Second, strategic logic. Iran faces an environment of maximum pressure: severe sanctions, direct military strikes on its missile capabilities and air defenses, ongoing confrontation with Israel. Demonstrating the ability to reach American civilian infrastructure is a rational asymmetric deterrent. It tells an adversary with overwhelming conventional dominance that military advantage does not make a society safe. Third, target selection. Water utilities are the path of least resistance in the critical infrastructure complex. An attacker seeking to demonstrate capability without crossing an escalation threshold would rationally choose water over power grids or nuclear-adjacent targets. The threshold for "this is a war act" is far higher for a compromised pump station than for a disrupted electric grid. Fourth, timing. With nuclear diplomacy stalled and tensions accumulating, the incentive to show reach is real. An attack that creates psychological impact without mass casualties fits the Iranian playbook of calibrated escalation. If I were given the national intelligence picture and it pointed to Iran, I would not be surprised. The prior probability is not zero. It is substantial. My objection is not to the substance of the suspicion. My objection is that the public is being asked to accept a verdict without seeing the evidence. In my audits, I learned that a ninety-percent-complete story and a one-hundred-percent-complete story are dangerously different. The edge cases are where criticality lives. In the Tezos audit, the vulnerability I found was in a latency condition most analysts had dismissed. Published proof changes the conversation. Assertions only repeat the headline. Precision is the only apology the chain accepts. It should be the only foundation for interstate accusation. The response should begin with technical honesty. Before sanctions are drafted, before retaliatory operations are ordered, before the narrative permanently solidifies, the forensic record must be completed. Hashes. Indicators. Timelines. Evidence. A case file. I want to propose something specific. The critical infrastructure community needs a public, verifiable incident ledger — anchored on distributed-ledger technology, open to technical scrutiny, maintained to preserve privacy while enabling validation. Not a classified file that agencies can quietly suppress. A hash-chained registry of attack indicators that any independent auditor can verify. I have spent the last five years building tools that trace financial flows across chains; the same cryptographic discipline can trace the fingerprints of a cyber intrusion across a network. The philosophical core of this proposal is simple. Every bug is a footprint left in haste. Every intrusion leaves artifacts. The question is whether we choose to record them. This event is a threshold regardless of who is responsible. It confirms — at a scale never previously documented — that US water infrastructure can be struck across multiple states in a coordinated fashion. That is a capability demonstration. The forensics must now match the scale of the claim. I have seen too many failures in my career to accept a headline in place of an audit. I have watched protocols collapse because their operators substituted marketing for mathematics. I have watched stablecoins die because their architects ignored the difference between assumption and proof. I will not watch the same error repeat in a system that delivers water to American homes. The ledger remembers what the headline forgets. It is time we built a ledger for the water running through American taps. Because right now, we have a headline, a suspicion, and seven states that still do not know how deep the compromise goes. History is not written; it is indexed. The index for this attack remains empty.