Iran International
Cyberattacks targeting water and wastewater facilities in at least seven US states appear to have been intended less to cripple infrastructure than to demonstrate Iranian reach, intimidate the public and shape perceptions, cybersecurity experts told Iran International.
"The psychological impact is what these attacks are intended to do,"said Annie Fixler, director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies (FDD).
"Iranian hackers in particular conduct what's called perception hacking," she said.
"They conduct a small-scale operation, they get into a network, they take a couple pictures of what they got, and then they claim to have caused a massive disruption because they're trying to cause a psychological impact even when they can't cause an actual true cyber impact."
Federal authorities last week warned that "malicious cyber actors" had targeted water and wastewater systems across at least seven states, with Minnesota reporting the largest number of incidents after around 30 water systems were disrupted. Officials urged utilities to disconnect vulnerable internet-connected equipment and switch to manual operations where necessary.
The FBI has opened an investigation but has not publicly attributed responsibility. However, multiple US media outlets, citing government officials familiar with the investigation, reported that Iran is the leading suspect.
President Donald Trump dismissed suggestions that Tehran was responsible, instead blaming Minnesota Governor Tim Walz, while Walz argued the attacks illustrated "what modern warfare looks like."
Why Iran?
Although no official attribution has been made, cybersecurity specialists say several characteristics of the campaign closely resemble previous Iranian operations.
"The particular systems they attacked are programmable logic controllers," Fixler said, referring to industrial control devices widely used in water facilities.
"The US government warned repeatedly earlier this year that Iranian actors were targeting those particular systems."
Earlier this year, the Cybersecurity and Infrastructure Security Agency (CISA) warned that Iranian-affiliated hackers were actively targeting internet-connected operational technology, including programmable logic controllers used in water infrastructure.
The agency later updated its advisory with additional guidance on securing vulnerable equipment.
Unlike financially motivated ransomware attacks, the latest incidents included no ransom demands.
"The first thing I look for is whether there's a ransom request," Fixler said. "We haven't seen that."
That absence points away from criminal hackers and toward a geopolitical operation, she said.
Amin Sabeti, a cybersecurity researcher specializing in Iranian cyber operations, said the campaign also reflects the typical strengths and limits of Iran's cyber capabilities.
"I don't think it was sophisticated, but it was a clever one," Sabeti said.
Rather than deploying cutting-edge exploits, he said the attackers appeared to exploit weak cybersecurity practices such as unchanged default passwords and poorly secured internet-connected equipment.
Compared with Russia and China, "they are a small boy in the town," Sabeti said, arguing Iranian operators excel at social engineering and exploiting simple vulnerabilities more than conducting highly sophisticated cyber campaigns.
A familiar playbook
The suspected campaign would fit a pattern established over recent years.
In late 2023, the IRGC-linked hacking group CyberAv3ngers targeted water facilities in Pennsylvania by compromising Israeli-made Unitronics programmable logic controllers, forcing operators to switch to manual controls.
Iran has also targeted Israeli water infrastructure. In 2020, Iranian hackers attempted to manipulate chlorine levels in Israeli water systems, according to Israeli and Western officials, prompting a reported Israeli cyber retaliation against Iran's Shahid Rajaee Port.
The same industrial control equipment targeted in previous Iranian operations has again become the focus of concern in the United States.
Fighting a war without missiles
Experts say the attacks fit neatly into Iran's broader doctrine of asymmetric warfare.
"They show that, for a big powerful country like America, they can still be reached. Iran can still touch them," security expert Roger Macmillan told Iran International.
"There is a huge psychological warfare piece... They can't attack us physically using missiles, but they can touch us digitally."
Macmillan said the campaign serves several purposes simultaneously: demonstrating that American critical infrastructure is vulnerable, gathering intelligence about similar systems across the country and reminding Washington that Tehran retains options beyond conventional military force.
"There's also an intelligence gathering piece," he said. "They will probe similar types of companies to see where the same weaknesses are and how they will exploit them."
As executions have accelerated in recent weeks, some Iranian social media users have increasingly portrayed the pre-dawn adhan as a reminder of hangings rather than the beginning of the day’s religious observances.
The adhan is the Islamic call summoning Muslims to the five daily prayers.
Iranian regulations state that death sentences should ordinarily be carried out at sunrise unless the court specifies another time. Executions are nevertheless widely associated with the early-morning hours, when prisoners’ families and supporters often wait for news as the dawn call to prayer is broadcast.
Social media anger turns toward religious symbols
Posts criticizing Islam and religious symbols circulated across Instagram and X following the latest executions.
An Instagram user wrote that the dawn adhan had become “a symbol and reminder of the execution of this country’s youth,” adding that a call intended to invite people to worship, peace and salvation had instead become associated with taking lives.
Activist Masih Alinejad wrote after clashes outside an execution site that the dawn call to prayer had become “only a symbol of death and execution.”
Another Instagram user wrote before planned executions in Isfahan that the young prisoners were due to be hanged “to the sound of the dawn call to prayer,” adding that it now carried “only the smell of death.”
Other users went further, posting profanity directed at Islam, the Quran, Shi’ite religious figures, the adhan and the Arbaeen pilgrimage. Some wrote that they no longer associated the dawn call with prayer but with executions.
IRGC-linked campaign urges crackdown
The IRGC-affiliated Fars News Agency said more than 700 people had signed a campaign on its platform by Tuesday, calling for the “maximum punishment” of those accused of “insulting Islamic sanctities online.”
Organizers cited Article 513 of Iran’s Islamic Penal Code and urged judicial and security authorities to take what they described as “effective and deterrent” action.
Under Article 513, insulting Islamic sanctities is punishable by between one and five years in prison. Cases classified as sabb al-nabi, or insulting the Prophet, can carry the death penalty.
Fars said campaign supporters called for tougher enforcement against people who “deliberately insult Islamic sanctities” online and urged authorities to prosecute offenders under existing legislation.
Judiciary spokesman Asghar Jahangir has previously said Iran continuously monitors cyberspace through a dedicated unit within the prosecutor general’s office and urged citizens to report alleged online offenses through official channels.
The campaign adds to broader efforts by Iranian authorities to tighten oversight of online speech as criticism over the recent executions continues to spread across social media.
The figures, presented at a public event hosted by the University of Tehran's Faculty of Urban Planning, offer the most detailed breakdown yet of damage across the capital following the conflict.
The report says District 4 in northeastern Tehran recorded the highest number of strikes, followed by District 21 in the west, District 1 in the north and District 22 in the northwest.
"The number of strikes in District 4 alone exceeded the combined total recorded in some provinces," Hossein Nouhi, a certified construction expert in Tehran's municipality, said during the event.
According to the report by Tehran Municipality's Urban Planning and Architecture Department, District 4 was hit 90 times, District 21 Tehran sustained 62 strikes, District 1 recorded 57 and District 22 recorded 55. District 17 in southwestern Tehran was the least affected, with three reported strikes.
Housing damage
The municipality said 50,849 residential units across Tehran sustained damage ranging from broken windows and doors to complete destruction.
Around 40,000 homes required minor repairs, about 8,900 suffered more extensive architectural damage, 415 buildings required structural reinforcement or reconstruction and 2,042 homes were completely destroyed and must be rebuilt, according to the report.
District 4 recorded the largest number of damaged residential units with 7,948, followed by District 2 with 4,037, District 15 with 3,490, District 11 with 3,432, District 21 with 3,205 and District 7 with 3,196.
The report also found that District 7 had the highest number of completely destroyed homes, with 429 units, followed by District 4 with 325 and District 11 with 248.
Estimated economic and environmental costs
Nouhi put the country's economic losses from the 40-day conflict at an estimated $280 billion, excluding psychological impacts and the cost of restoring industrial production. He argued that the conflict highlighted the need to require shelters in new high-rise developments.
Separately, geologist Mehdi Zare’ estimated that military strikes generated around 10 million metric tons of debris across affected urban areas by August 1. He said the waste includes concrete, steel, glass, asbestos and industrial pollutants that could create long-term environmental and public health risks.
Zare’ also said the demolition and cleanup process released millions of tons of greenhouse gases, adding to the environmental impact of the conflict.
The report described the trend as the emergence of a "survival economy," in which even the smallest household possessions have become tradable assets as families struggle with soaring inflation and shrinking purchasing power.
Online classified advertisements, according to ILNA, increasingly feature offers to sell used work shoes and clothing, empty perfume bottles and natural hair for extensions, alongside listings advertising the rental of property deeds, salary slips and other financial guarantees.
From laptops to perfume bottles
The agency also highlighted growing demand for laptop rentals, with users seeking temporary access to devices for basic tasks such as typing documents, using Microsoft Office software or attending online classes.
"What may initially appear strange or even humorous actually reflects declining purchasing power, changing consumption patterns and households' efforts to generate cash," ILNA wrote.
The shift, The report said, illustrates how ownership is increasingly giving way to renting, while everyday items are being used until the very end of their economic value.
The findings come as inflation continues to weigh on Iranian households. According to the Statistical Center of Iran, annual inflation reached 66% in the Iranian month ending in late July, while year-on-year inflation stood at 87.9%.
A 'survival economy'
The growing number of advertisements, the report said, reflects a broader transformation in household finances, where assets once considered worthless or purely personal are increasingly being converted into immediate sources of income.
The agency said many sellers now bundle together low-value household items to improve their chances of making a sale, while advertisements offering natural hair have also become more common, with prices ranging from negotiable sums to several million rials depending on length, color and quality.
The report follows other recent signs of mounting financial pressure, including the spread of installment payments for healthcare and pharmaceuticals, as many Iranian families struggle to cover everyday expenses.
The expansion of the market for second-hand goods, rentals and personal assets, ILNA said, reflects a growing effort by households to generate cash in an economy where almost anything can become a source of income.
Omid Behzad and Pouria Safvat, the judiciary's news outlet said, were executed on Monday, after Iran's Supreme Court upheld their death sentences.
According to Mizan, the two men transmitted “coordinates, images and information about Iranian military and security sites to officers from Israel's Mossad intelligence agency and affiliated communication channels” during the 12-day and 40-day wars in 2025 and 2026.
The pair, the report said, were identified and arrested by the Islamic Revolutionary Guards Corps' intelligence organization but did not specify when, where or how they were detained.
The judiciary outlet also said Behzad maintained direct contact with the administrator of a Telegram channel linked to Israel and supported the US and Israeli military campaign against the Islamic Republic.
Mizan cited Behzad's confessions as evidence, although rights groups have for years documented that Iranian authorities have extracted confessions under coercion, torture or harsh detention conditions.
Iranian authorities use broadly worded charges such as espionage, acting against national security, armed rebellion, enmity against God and corruption on earth to crush dissent and remove political opponents.
Human rights organizations say these labels are routinely applied to protesters, dissidents and political prisoners to portray them as security threats and provide a legal pretext for execution.
Amnesty International, Human Rights Watch and UN experts have documented repeated cases in which such convictions were issued by revolutionary courts after grossly unfair or highly expedited proceedings, with defendants denied meaningful access to lawyers and verdicts based on torture-tainted forced confessions.
Charges against Safvat
Safvat, Mizan said, photographed Iranian air defense systems from rooftops during the 12-day war and sent the images through communication channels linked to Israel.
The outlet said some of the locations he photographed were later bombed. Without providing evidence, it also alleged Safvat had direct contact with Mossad in some instances and sent messages to Iran International.
The court, according to Mizan, sentenced both men to death based on what it described as “explicit confessions, technical evidence, recovered messages and other evidence.” The sentences were upheld by the Supreme Court before being carried out on Monday.
Wider crackdown
Iran has intensified arrests, prosecutions and executions in recent months, with authorities sentencing or executing dozens of people on charges including espionage, involvement in protests and membership of the exiled opposition group Mujahedin-e Khalq (MEK).
Human rights groups and activists say the authorities have expanded the crackdown following recent military confrontations, arguing that the campaign is intended to deter renewed public unrest over Iran's deepening economic and political crises.
Iran's latest wave of public hangings of protesters amounts to "killings" and "murders" that form part of a continuing crime against humanity, former United Nations prosecutor Professor Payam Akhavan told Iran International's Eye for Iran.
“What we actually have in Iran are arbitrary executions. These are killings. They are murders,” Akhavan said. "Specifically, the case can be made that this is a crime of extermination, given the large scale of the killings."
