Digital Front Monitor

A leak-forum vendor is advertising Israel’s full population registry as a current breach. The sample is genuine — and two decades old, tracing back to a 2006 insider theft.

Several rolling vendor dashboards on the Iran–Israel cyber conflict carry page ages of days while their contents are undated. Mid-August, not a lull in operations, is the likeliest explanation for the silence.

TechCrunch’s 14 August explainer on the US water-utility intrusions still calls the attacks “allegedly carried out by Iran.” Two weeks after the first alerts, the number of affected states has drifted upward without anyone in Washington fixing it.

A TechCrunch report on Iran’s nationwide internet shutdown returns repeatedly in queries scoped to August 2026. Its internal evidence dates it to the second week of January.

Foreign Policy ran the twelve-state figure on 13 August. The figure is roughly a week old, the count moved from seven to twelve in about that time, and no headline in the record asserts a physical effect on any treatment plant.

Citizen Lab’s telecom-exploitation report is three months old, the Haaretz hack-and-leak series ran between January and May, and the Iran shutdown paperwork is from winter. None of it is carrying a visible date as it circulates.

Between 24 July and 11 August the reported count of US water utilities hit by intrusions grew from seven states to twelve. The primary federal document, as published, attributes the activity to “malicious cyber actors” and stops there.

Four of the Israel-facing cyber items circulating in the current window were reported between 7 January and 4 May 2026. The freshest connectivity measurement available for Iran is three months old.

NPR’s 12 August report puts operating technology at more than 30 Minnesota water systems inside a late-July wave and quotes officials who suspect Iran. The two federal documents behind the story do not agree on who did it.

Most of what circulated on this beat between Monday and Thursday was an unconfirmed assertion, a vendor distribution or months old. The one non-commercial dataset published this week remains unopened here.

The same intrusions at US municipal water systems are being carried simultaneously as an open inquiry into Iranian involvement and as a settled government attribution. Nothing in the retrievable record resolves which is right.

The window produced no new platform influence-operation report and no new surveillance-vendor finding. What is moving through feeds is spring material with recent crawl dates, including one paid newsletter misdating its own brief.

A multi-state campaign against internet-facing controllers at US water utilities entered its second week with the investigating bureau still silent on who is responsible. The only Iran attribution on the record belongs to anonymous intelligence sources quoted by one newspaper.

No new Citizen Lab or Amnesty publication, no platform takedown announcement and no shutdown event fell inside 7–10 August. What is circulating instead is April-to-July research, undated, alongside a commercial dashboard refresh.

The count carried in US headlines moved from seven to twelve inside a week, with the attribution to Iran-linked actors hedged in every outlet that printed it.

The material moving through timelines on the Iran cyber file dates to January, March and April; the one dated artefact inside the window is a shutdown dataset whose numbers nobody has yet pulled.

An operational-technology campaign against US water systems has produced pressure loss, flooding and one boil-water advisory. The Iran attribution belongs to anonymous officials, not to any federal agency.

With no first-tier APT report in the window, search results are filling the gap with rolling vendor dashboards and four-month-old advisories carrying near-identical headlines.

Reported intrusions at US water and wastewater systems expanded from seven states to twelve between 2 and 6 August. Every mainstream outlet in the window still hedges the attribution to Iran.

The federal warnings ranking highest on the water-utility story predate the incidents they appear to answer. So does most of the spyware and Israeli-cyber material surfacing alongside them.

The FBI and EPA warned water utilities about “malicious cyber actors” on 30 July. By 5 August the count had nearly doubled, Bloomberg had promoted the suspects into its headline, and nobody had published a list of who was hit.

CISA’s AA26-097A carries the strongest government attribution to Iranian-affiliated actors in the file. It was published in April 2026 and last updated 22 July — before the water intrusions it is being used to explain.

Federal agencies warned on 30 July that actors are remotely tampering with water controls. The word “Iranian” appears in coverage only through a single anonymous law-enforcement source, and investigators are also probing whether the intruders wanted to look Iranian.

Most of the cyber material circulating with the water story predates the water story. The dates matter, because the sequencing is the strongest part of the case and the recirculated numbers are the weakest.

A joint FBI-EPA-CISA warning on 30 July described degraded water operations at US utilities. The Iranian authorship being reported around it has not been stated on the record by any agency.

At a Cabinet meeting on Friday, the president said “I think that Minnesota is behind it.” The FBI, EPA and CISA had issued their warning the day before without naming a state or an actor.

Anonymous officials told three networks the tradecraft looks Iranian. No US agency has said so on the record, and Trump used a Cabinet meeting to reject the idea outright.

CISA’s PLC advisory is the strongest document in the file and the only multi-agency, on-the-record source naming Iranian-affiliated actors. Neither of its dates falls inside the past week.

Two US networks report a multi-state intrusion campaign against municipal water systems; the Washington Post reports the President publicly rejecting the Iran attribution circulating around it. What the intruders actually did remains unestablished.

The CISA advisory framing coverage of the water intrusions carries an identifier and a filing number that both point to early April 2026. Its own title calls it an update.

US spy agencies have reportedly concluded Iran was likely behind intrusions at more than 30 Minnesota water systems. On Friday the President publicly rejected that finding, and no federal body has attributed the activity to anyone on the record.

The UK Supreme Court dismissed Manama’s appeal on 27 July in a suit brought by two exiled activists infected with FinSpy while in Britain. The ruling is a jurisdictional precedent, not a finding of fact.

The preliminary US assessment reported Thursday rests on anonymous officials, the absence of a ransom demand and a reading of tradecraft. Minnesota’s own IT agency has attributed nothing.

Joint advisory AA26-097A widened the target list to Siemens and Schneider and documented stolen PLC project files. It landed four days before the Minnesota utilities were hit.

The state activated a whole-of-government response after a coordinated attack on operational technology at community water utilities on 26–27 July. Headlines have already assigned it to Iran. Minnesota, the FBI and CISA have not.

A June claim by a Tehran-linked group has been folded into this week’s coverage with its most important forensic finding removed. A separate 23 July claim about Maryland has no confirmation from anyone in Maryland.

State IT officials say operational technology at more than thirty community water utilities was targeted over two days, with no boil-water advisories and no attribution by any party. Four cities have spoken publicly; the rest have not.

CISA’s AA26-097A, refreshed on July 22, names specific Rockwell, Schneider and Siemens controllers. No one has said whether any of the Minnesota utilities ran them — which is the difference between a pattern and a link.

A Cloudflare retrospective, an Israeli official’s month-old “surge” claim and a Palo Alto living document are all in circulation as current reporting on the 2026 cyber conflict. None of them describes this week.

The most citable document this desk found on Iranian cyber operations is a CISA advisory from roughly a week ago. The most quotable number is a security vendor’s running tally that does not separate claims from confirmed incidents.

The joint advisory AA26-097A was revised on 22 July to add detection guidance and two new PLC manufacturers. It documents a campaign that began in November 2023 — not a new intrusion this weekend.

The Forbidden Stories–Amnesty consortium published its Moroccan whistleblower investigation on 16 July. It is circulating this weekend as though it broke this weekend.

An advisory first published in April was updated on 22 July to cover three controller manufacturers instead of one. The technique it describes involves no vulnerability and no patch.

The persona Handala says it took IranWire’s correspondence and handed it to Iranian intelligence. SOCRadar marks the claim unverified — and a separate report circulating this week has an attribution problem.

Three-quarters of Iranian users are routing around the national internet. The official who presented the number told a Tehran seminar the policy has been left with no legitimacy at all.

Attackers cloned Bahrain's Civil Defence branding and the Play Store to push a four-stage Android implant to Gulf civilians during live missile alerts. The researchers found Cyrillic in the code and no state at all.

A joint US advisory now says Iranian-affiliated actors are inside internet-exposed controllers at American water and energy utilities — and has widened the named target hardware from one vendor to three.

A newly exposed Iranian intelligence crew burrowing into Israeli IT providers marks the shift from noisy hacktivism to persistent espionage — as hostile incidents against Israel triple.

A synchronized campaign is recycling documented RSF atrocities as “Islamist violence against Christians,” laundering both the paramilitary's crimes and its Gulf sponsor's role in a single edit.

Five months in, Tehran's most durable gain is not kinetic but narrative — an AI-and-hacktivist ecosystem, amplified on cue by Moscow and Beijing, inside whose feed the Gulf now physically sits.