01Summary
On November 12, 2025, multiple water treatment and distribution facilities in Israel were hit with wiper malware. The attackers claimed they could have caused physical damage by altering chlorine levels and water pressure but chose to issue a warning instead. Internal documents and SCADA screenshots were leaked online as proof of access.
02Background
Water infrastructure is a high-value symbolic and practical target in Middle East cyber conflicts. Israel has some of the world's most advanced water management systems.
03Key revelations
- 01Increasing willingness of hacktivists to target life-critical infrastructure.
- 02Persistent vulnerabilities in industrial control systems.
04Technical analysis
Attackers gained access through compromised third-party maintenance accounts and exploited unpatched ICS/SCADA systems. Wiper malware was deployed on HMIs and engineering workstations.
- Attack vector
- Compromised third-party credentials
- Attack method
- Lateral movement into ICS networks + Wiper deployment
- Initial access
- Third-party compromise
- Lateral movement
- ICS network pivoting
- Exfiltration
- Targeted screenshots and documents
- Tool / malware
- Custom wiper malware
- Malware type
- Wiper / Destructive
Vulnerabilities exploited
- Weak third-party access controls
- Legacy ICS systems
05Threat actor
CyberAv3ngers – Pro-Iran hacktivist collective known for targeting Israeli and Western critical infrastructure with destructive malware.
Aliases
- Soldiers of Solomon
Attribution sources
- Israeli National Cyber Directorate
- CISA
- BleepingComputer
06Victims and impact
Additional victims
- Several regional water treatment plants
Countries affected
- Israel
07Data exposed
Data types
- SCADA Screenshots
- Internal Operational Documents
- Infrastructure Schematics
Notable documents
- Leaked SCADA screenshots
08Financial damage
Emergency response costs and temporary operational restrictions.
09Timeline
- 2025-11-12Coordinated attacks on multiple water facilities.
- 2025-11-13CyberAv3ngers claims responsibility and leaks proof.
10Reaction and fallout
Public reaction
Significant public anxiety regarding water safety and national security.
Political impact
Strong condemnation from Israeli and U.S. governments.
Geopolitical consequences
Further escalation in Iran-Israel cyber shadow war.
11Legal
International investigation ongoing.
12Aftermath
Policy changes
- Accelerated air-gapping and segmentation of critical water systems.
Security improvements
- Emergency ICS security upgrades across Israel.
13Significance and legacy
Significance
One of the most serious attempts to disrupt critical civilian infrastructure via cyber means in 2025.
Legacy
Served as a wake-up call for global protection of water and utilities from hacktivist and nation-state threats.
14Disclosure and media
- Authentication
- Hacker-published screenshots and videos
Publishing organisations
- The Times of Israel
- BleepingComputer
- Recorded Future
15Field notes
- 01The attackers claimed they could have caused chlorine overdosing but chose not to.
16Resolution
Attack contained; no physical damage to water supply reported.
17Sources
Official documents
- Israeli National Cyber Directorate Alert
References
- [1]Israeli government statements
- [2]BleepingComputer
- [3]Recorded Future reports