A Late-July Advisory and an April One Are Circulating as Responses to This Week’s Intrusions

The joint CISA, FBI and EPA update on Iran-affiliated threat actors targeting programmable logic controllers is roughly two weeks old, dating to late July. It is being recirculated this week as though it were a response to the Minnesota incidents; it predates them. Beneath it sits an EPA, FBI, CISA and NSA joint advisory on water systems and Iranian activity dated 7 April 2026 — four months old — which is also ranking high on searches for this week’s events. The Tenable blog post on the Minnesota utilities, published on or about 5 August, cites a CISA advisory identifier, AA26-097A; Tenable sells operational-technology exposure management, and the identifier has not been checked here against CISA’s own text or its date. Two documents written before an event do not become evidence about it by appearing above it in a results page.

The same dating problem runs through the adjacent files. Middle East Eye’s report on a Moroccan whistleblower describing Pegasus use against dissidents is about two weeks old and is surfacing in fresh-spyware searches. The Times of Israel piece on the national cyber chief describing a surge in Iranian attacks is dated 29 June. Symantec’s research on the Seedworm cluster and US infrastructure is from March. Citizen Lab’s “Hide and Seek” Pegasus survey is from 2018. SOCRadar’s Iran–Israel dashboard is continuously updated and undated, which makes it permanently appear current; it is a vendor marketing asset. On the partisan edge, legalinsurrection.com is still running the seven-state figure The Record superseded, and a piece on Iran and Minnesota water is circulating on a domain registered as cambridgeanalytica.org. This desk found no in-window activity on platform takedowns, AI-generated propaganda operations, new wiper deployments, or Israeli and Gulf offensive cyber.

One in-window item deserves separating from the pile rather than folding into it. Bloomberg reported on 6 August that Wall Street firms were targeted by attempted cyberattacks. The word in Bloomberg’s own headline is “attempted.” No attribution is visible at headline level. An attempt against a bank and an intrusion into a utility are not the same class of fact, and the pressure this week runs toward stacking them into one narrative about one state. A note on this desk’s own limits: the sweep behind this section verified publishers, headlines, URLs and publication dates, but not article bodies. There are no quotes in this section because none were verified. Where a claim rests on a vendor blog or a partisan site, it is labelled above.

Assessment: Recirculation is the cheapest form of escalation. Nobody has to fabricate anything: a search engine promotes a four-month-old federal advisory to the top of a live story, and readers reasonably infer that Washington has responded when Washington has said nothing new. The vendor dashboards make this worse by design, since undated continuous updating is indistinguishable from breaking news. Watch two things into the weekend. Whether the Wall Street attempts acquire an Iranian subject without new evidence, and whether the water-versus-electricity regulatory gap — mandatory standards for the bulk grid, voluntary for water — becomes the legislative vehicle this story is eventually spent on.