Iranian group claims a Texas telecom outage AT&T says was cable theft
APT IRAN told its Telegram followers it hit telecommunications and a water utility in Texas before the 9/11 anniversary. The carrier says there is no evidence, and no public record of a Texas water breach exists.
A group calling itself APT IRAN, associated with the IRGC-linked CyberAv3ngers, wrote on Telegram on Tuesday that it had attacked “telecommunications and other critical infrastructure in Texas” and disrupted an unnamed Texas water utility. The claim was first reported by Threat Beat, a publication associated with the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University. The underlying event is real: Downdetector reports for AT&T in Texas peaked shortly before 3 p.m. Monday at 5,990, clustered around Houston, Spring, Dallas, Fort Worth, Cypress and Austin, and the outage was mostly resolved by 6 p.m. AT&T first pointed to fiber equipment and cable issues, then hardened its position. “We have no evidence to support that claim,” a spokesperson told Chron on Wednesday. “Our assessment indicates that attempted cable theft led to the outage.”
The group answered the denial on Wednesday without naming AT&T or any other target: “That those idiots don’t even know what we tampered with, what we have access to, and what things were disrupted!” It added: “Oh yes, we warned on this date and we are still saying it. This is so ridiculous that a country that claims to own everything in cyberspace is now resorting to lies and honeypots!” The load-bearing detail sits underneath all of it. Threat Beat reports there have been no known public reports of recent breaches of Texas water systems. The alliance behind the threats is documented: on 27 March, Handala, APT IRAN and CyberAv3ngers announced a joint vow to inflict “irreparable damages” on US water infrastructure if Iranian water systems were threatened. The group promised to “intensify” attacks before today’s 25th anniversary of 9/11.
Assessment: Read the chain of custody before the claim. Chron, KHOU, CBS Texas, 12News and the aggregators all trace to one Telegram post and one first report from a university-affiliated outlet that is not a wire — a single source wearing a dozen mastheads. Two things settle this and neither has happened: a police report on attempted cable theft in the affected corridors, or a statement from EPA Region 6 or the Texas Commission on Environmental Quality on the unnamed utility. Note also what is absent. No US government body has attributed the outage. CISA silence on a claimed telecoms strike by an IRGC-linked group during a week the group pre-announced is data, not a gap. A self-set deadline that passes quietly is the cheapest honest test of capability versus noise.