US federal investigators are investigating the possibility that Iranian state-backed hackers may be behind a series of malicious cyberattacks that occurred last week against water systems in seven US states, including Minnesota. CBS News reported the news, noting that the Middle East conflict has entered its sixth month.
According to Minnesota IT Services, more than 30 community water systems in Minnesota were targeted during a two-day campaign in late July. The attacks affected the operational technology used to monitor and control water infrastructure, prompting state and federal agencies to initiate a coordinated response. Among the affected businesses, the city of Braham reported that attackers temporarily disabled computerized operational controls, shutting down the well and water treatment plant until operators restored service. Other communities, including Plymouth, South St. Paul, and Maple Plain, reported disruptions to automated control systems or communications, but maintained drinking water supplies and wastewater treatment through manual procedures. Officials in each community said the drinking water remained safe and no contamination occurred.
The incidents then spread beyond Minnesota. Michigan authorities recently revealed that nine water systems in the state were also subjected to cyberattacks, although operators maintained service security and no public health impacts were reported. The FBI, the U.S. Environmental Protection Agency (EPA), and the Cybersecurity and Infrastructure Security Agency (CISA) are investigating the incidents along with state agencies.
And if the hacks do damage, cryptocurrency is used to pay for hacktivists or to make purchases in a way that evades inspections and penalties. Reuters has published a report accusing Iran’s Islamic Revolutionary Guard Corpsof using gambling sites to move approximately $4 billion.
According to a Reuters investigation, Iran’s Islamic Revolutionary Guard Corps has for years used a network of thousands of Farsi-language gambling sites and a Dubai-based cryptocurrency exchange to transfer funds and evade sanctions. According to the agency, the amount of funds transferred through this system is estimated at approximately $4 billion.
The investigation also named online figures such as Sasha Subhani (son of the former Iranian ambassador to Venezuela, known on social media for his lavish lifestyle) and Pouyan Mokhtari (an Iranian blogger quoted in publications promoting online gambling sites).
The Dubai office belongs to Shelbit, an unlicensed cryptocurrency exchange run by Iranian émigré Siavash Keyvanpour. Its main clients include an online casino network with over 2,000 sites. The company is publicly represented by two Iranian influencers with ties to high-ranking officials.
In 2023, an Iranian court found the influencers, as well as Keyvanpour, complicit in a case involving an illegal gambling operation. Gambling is banned in Iran, but this gambling network, according to Reuters, has access to Iran’s electronic payment system, which is controlled by the country’s central bank.
Proceeds from illegal gambling activities are sent to Shelbit, where they are converted into cryptocurrency and transferred through international exchanges, thus obscuring the origin of the funds. Blockchain records show that Shelbit has transferred hundreds of millions of dollars to major cryptocurrency market participants, including the world’s largest exchange, Binance.
According to Reuters, the gambling network is just one of Shelbit’s clients. The platform also facilitates transactions for the Central Bank of Iran and other sanctioned organizations, allowing it to be used as a tool to circumvent international sanctions.
Shelbit also interacts with cryptocurrency wallets that the Israeli government has linked to the Islamic Revolutionary Guard Corps (IRGC). An investigation found that the IRGC seized control of Iran’s largest gambling sites several years ago and has since used them to transfer funds abroad. Shelbit’s total transaction volume since May 2024 is at least $4 billion.
Reuters notes that the influx of funds into the exchange continued even before the US-Israeli war against Iran. “Cryptocurrencies continued to flow even after Iran repeatedly attacked the United Arab Emirates, including a drone landing less than a kilometer from the exchange’s headquarters,” the report states.
Antonio Albanese e Graziella Giangiulio
Follow our updates on Geopolitical Gleanings - Spigolature geopolitiche: https://t.me/agc_NW and on our blog The Gleanings of AGCNEWS - Le Spigolature di AGCNEWS: https://spigolatureagcnews.blogspot.com/
