(../../favicons/favicon-96x96.png) (../../favicons/favicon.svg) (../../favicon.ico) (https://threatbeat.com/favicons/apple-touch-icon.png) (../../site.webmanifest) Iran hackers after denial of Texas AT&T claim: ‘Idiots don’t even know what we tampered with’ - Threat Beat (index.html) (oEmbed (JSON)) (https://threatbeat.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fthreatbeat.com%2Fattacks-and-incidents%2Firan-hackers-after-denial-of-texas-att-claim-idiots-dont-even-know-what-we-tampered-with%2F) (oEmbed (XML)) (https://threatbeat.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fthreatbeat.com%2Fattacks-and-incidents%2Firan-hackers-after-denial-of-texas-att-claim-idiots-dont-even-know-what-we-tampered-with%2F&format=xml) (../../app/themes/kinetic/public/fonts/inter-v18-latin-600italic.6c9729.woff2) (../../app/themes/kinetic/public/fonts/inter-v18-latin-italic.cbd2c2.woff2) (../../app/themes/kinetic/public/fonts/inter-v18-latin-600.efad95.woff2) (../../app/themes/kinetic/public/fonts/inter-v18-latin-900.4c4b46.woff2) (../../app/themes/kinetic/public/fonts/inter-v18-latin-regular.360a94.woff2) (../../app/themes/kinetic/public/fonts/roboto-condensed-v27-latin-700.0bf715.woff2) (../../app/themes/kinetic/public/fonts/roboto-condensed-v27-latin-regular.f20c78.woff2) (../../app/themes/kinetic/public/fonts/work-sans-v19-latin-regular.ab9041.woff2) (../../app/themes/kinetic/public/css/app.21ee3f.css) (../../app/plugins/mailin/css/mailin-front.css@k=saJwl0RWgMXPg.css) (https://threatbeat.com/wp-json/) (JSON) (https://threatbeat.com/wp-json/wp/v2/posts/13142) (RSD) (https://threatbeat.com/wp/xmlrpc.php?rsd) (../../app/themes/kinetic/public/fonts/inter-v18-latin-600italic.6c9729.woff2) (../../app/themes/kinetic/public/fonts/inter-v18-latin-italic.cbd2c2.woff2) (../../app/themes/kinetic/public/fonts/inter-v18-latin-600.efad95.woff2) (../../app/themes/kinetic/public/fonts/inter-v18-latin-900.4c4b46.woff2) (../../app/themes/kinetic/public/fonts/inter-v18-latin-regular.360a94.woff2) (../../app/themes/kinetic/public/fonts/roboto-condensed-v27-latin-700.0bf715.woff2) (../../app/themes/kinetic/public/fonts/roboto-condensed-v27-latin-regular.f20c78.woff2) (../../app/themes/kinetic/public/fonts/work-sans-v19-latin-regular.ab9041.woff2) (index.html#main) Skip to content SPECIAL THREATS TO CRITICAL INFRASTRUCTURE IN IRAN CONFLICT | (https://threatbeat.com/project/the-risk-for-cyber-or-u-s-critical-infrastructure-attacks-in-iran-conflict/) READ MORE → (https://threatbeat.com/) Threat Beat Home Open Menu Search Loading... (https://threatbeat.com/) Threat Beat Home (https://threatbeat.com/section/attacks-and-incidents/) Attacks • Incidents (https://threatbeat.com/section/threats/) Threats (https://threatbeat.com/section/adversaries/) Adversaries (https://threatbeat.com/section/government-and-industry/) Government • Industry (https://threatbeat.com/section/critical-infrastructure/) Critical Infrastructure (https://threatbeat.com/section/commentary-and-analysis/) Commentary • Analysis (https://threatbeat.com/section/video/) Video Open Menu Search Loading... (https://threatbeat.com/section/attacks-and-incidents/) Attacks and Incidents (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/communications/) Communications Iran hackers after denial of Texas AT&T claim: ‘Idiots don’t even know what we tampered with’ () (Mike Mozart of TheToyChannel and JeepersMedia/Flickr) (https://threatbeat.com/bio/bridget-johnson/) () (https://threatbeat.com/bio/bridget-johnson/) Bridget Johnson Executive Editor, Threat Beat; Editorial Director, McCrary Institute (https://bsky.app/profile/bridgetjohnson.bsky.social) (https://www.linkedin.com/in/bridget-johnson-356002152/) (https://x.com/bridgetcj) Share (https://www.facebook.com/sharer/sharer.php?u=https://threatbeat.com/attacks-and-incidents/iran-hackers-after-denial-of-texas-att-claim-idiots-dont-even-know-what-we-tampered-with/) Share to Facebook (https://bsky.app/intent/compose?text=Iran+hackers+after+denial+of+Texas+AT%26amp%3BT+claim%3A+%26%238216%3BIdiots+don%26%238217%3Bt+even+know+what+we+tampered+with%26%238217%3B%20-%20https%3A%2F%2Fthreatbeat.com%2Fattacks-and-incidents%2Firan-hackers-after-denial-of-texas-att-claim-idiots-dont-even-know-what-we-tampered-with%2F) Share to Bluesky (https://www.linkedin.com/shareArticle?mini=true&url=https://threatbeat.com/attacks-and-incidents/iran-hackers-after-denial-of-texas-att-claim-idiots-dont-even-know-what-we-tampered-with/&title=Iran hackers after denial of Texas AT&T claim: ‘Idiots don’t even know what we tampered with’&summary=&source=Threat Beat) Share to LinkedIn More sharing options By Bridget Johnson • Sep 10, 2026 Iranian hackers pushed back after Wednesday’s denial of their (https://threatbeat.com/attacks-and-incidents/iran-hackers-claim-texas-att-outage-vow-to-intensify-attacks-before-9-11/) claim that they hit AT&T service in major Texas cities on Labor Day, declaring that those rebuffing their claim “don’t even know what we tampered with” or “have access to.” APT IRAN, which (https://threatbeat.com/threats/iran-hackers-minnesota-warning-ignored-critical-events-to-hit-3-u-s-infrastructure-sectors/) threatened at the end of August that “critical events” will hit three U.S. critical infrastructure sectors including telecommunications following the water hacks in Minnesota and elsewhere, claimed in a Tuesday post on their Telegram channel that they were behind the AT&T outage and breached an unnamed water utility in the Lone Star State. The Houston Chronicle (https://www.chron.com/news/houston-texas/article/att-outage-houston-22420987.php) reported that users began reporting AT&T issues at Downdetector on Sunday, with a “massive surge of reported outages” reported after noon on Labor Day. “The largest cluster of (https://downdetector.com/status/att/map/) outages reported came from the (https://downdetector.com/status/att/houston_166/) Houston area, followed by Spring, Dallas, Fort Worth, Cypress and Austin,” the outlet reported. “More than 40 percent of reported outages cited problems tied to 5G home internet.” APT IRAN, which is closely linked to the Islamic Revolutionary Guard Corps-affiliated CyberAv3ngers and has previously focused on operational technology targets, posted a statement on their Telegram channel Tuesday evening Eastern time taking credit for the outage. “We have attacked telecommunications and other critical infrastructure in Texas, including disrupting AT&T internet service in Houston, Dallas, Austin, and San Antonio, and we have also penetrated a water utility in Texas, disrupting water service,” the APT IRAN statement said. “The American people, you know who is responsible for these disruptions!” the group added. “Trump’s adventures have allowed these attacks to continue and will intensify until September 11th, we will show you what is happening.” An AT&T spokesman said “we have no evidence to support” the claim made by APT IRAN. “Our assessment indicates that attempted cable theft led to the outage,” the spokesman said. “Internet service across Dallas and surrounding areas is operating normally, and we continue to monitor our network and review relevant information.” On Wednesday afternoon Eastern time, after the telecom company’s statement, APT IRAN released a post on their Telegram channel that referenced an excerpt from their “message to the United States and the American People” posted on Sept. 4: “From this moment on, any disruption, disruption or instability in infrastructure, etc., regardless of its scale and duration, must be assessed within the framework of a new phase of confrontation and mutual pressure between the United States and Iran, because the rules of the game have changed.” “Oh yes, we warned on this date and we are still saying it,” APT IRAN said Wednesday. “This is so ridiculous that a country that claims to own everything in cyberspace is now resorting to lies and honeypots!” “You know what’s the funniest thing?” the hacking group added. “That those idiots don’t even know what we tampered with, what we have access to, and what things were disrupted!” The latest statement didn’t mention AT&T or any other alleged target by name. There have been no known public reports about recent breaches of water systems in Texas. A short video accompanying APT IRAN’s Tuesday claim showed “HACKED_BY_APT_IRAN” and “HACKED_BY_CyberAv3ngers” being added to the “programs” file in an unknown system. The beginning of a system name ending with “PLC1” was blacked out by a gray bar. The Cybersecurity and Infrastructure Security Agency “urgently” (https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a) warned critical infrastructure organizations in July of “ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs).” On Aug. 31, the Trump administration (https://www.axios.com/2026/08/31/white-house-texas-water-cyberattacks) said Texas would be the first state in a pilot program to assist water utilities with cybersecurity. APT IRAN (https://threatbeat.com/attacks-and-incidents/minnesota-water-attacks-were-only-to-warn-iran-hackers-claim-while-taking-responsibility/) claimed in a mid-August statement that they conducted the end-of-July hacks on the water systems of dozens of communities “only to warn” of their broader capabilities to strike U.S. critical infrastructure. “The infrastructure of electricity, telecommunications, water, and anywhere in America that you think is under our control, and whenever America acts arrogantly, we will press the button,” the group later (https://threatbeat.com/attacks-and-incidents/iran-hackers-name-u-s-states-targeted-in-water-attacks-deny-responsibility-for-uk-power-plant-outage/) added on Aug. 23, claiming they had targeted water systems in Minnesota, Michigan, Georgia, New Jersey, South Dakota and Arkansas. OSINT EVERY MORNING IN YOUR INBOX: (https://lp.constantcontactpages.com/sl/fS5OMD4/mccrarysignup) Subscribe On Aug. 30, the group (https://threatbeat.com/threats/iran-hackers-minnesota-warning-ignored-critical-events-to-hit-3-u-s-infrastructure-sectors/) declared in a Telegram message, “Soon, the United States will witness unexpected and critical events in the energy, water, and telecommunications industries.” “We had previously warned that anyone who encroaches on this soil and threatens our beloved Iran will pay for this mistake with their lives,” APT IRAN’s threat continued. “You ignored our warnings, and we in Minnesota warned you again. You ignored them again; but this time we will sew the lips and mouths of the American people together.” Last week, APT IRAN doubled down on recent threats to launch more attacks on U.S. critical infrastructure sectors, vowing that “the American people will face numerous problems” in response to a Sept. 1 missile strike that hit a wedding in Kuhestak. “Self-defense” in response, the hacking group said, “may take the following forms: A few days of no drinking water, disruptions to mobile phone and internet networks, disruptions to energy, gas and electricity infrastructure.” The Washington Post (https://www.washingtonpost.com/world/2026/09/06/deadly-iran-wedding-strike-likely-due-us-weapon-missing-nearby-target/) reported Saturday that “the Pentagon is investigating the high likelihood that an explosion in southern Iran that destroyed a home hosting a wedding celebration was caused by a U.S. bomb that missed a nearby target.” Iranian hacking groups have declared a focus on U.S. infrastructure targets since the war began. At the end of March, APT IRAN and Handala, which is also affiliated with the IRGC, issued a unified infrastructure threat in conjunction with CyberAv3ngers. “Previous experience has shown that this warning is testable and incidents have occurred in the past for the water infrastructure of the United States,” APT IRAN (https://threatbeat.com/attacks-and-incidents/major-iranian-hackers-unite-threaten-irreparable-damages-to-u-s-water-systems/) said in a March 27 post on the group’s Telegram channel. “Therefore, it is emphasized to refrain from threatening the water infrastructure of Iran.” “If this warning is not heeded, irreparable damages will be inflicted on the other side,” it concluded. Latest Trending (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/communications/) Communications (https://threatbeat.com/adversaries/nato-allies-foil-russian-subsea-cable-sabotage-plot/) NATO allies foil Russian subsea cable sabotage plot (https://ca.news.yahoo.com/exclusive-nato-allies-foil-russian-060326071.html) Reuters via Yahoo • Sep 10, 2026 (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology (https://threatbeat.com/threats/for-years-they-warned-ai-could-kill-all-humans-now-people-are-listening/) For years they warned AI could kill all humans. Now people are listening (https://www.washingtonpost.com/technology/2026/09/10/years-they-warned-ai-could-kill-all-humans-now-people-are-listening/) The Washington Post • Sep 10, 2026 (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/government/) Government (https://threatbeat.com/government-and-industry/cisa-head-says-agency-must-change-quickly-to-prevent-the-worst-that-could-happen/) CISA head says agency must change quickly to prevent the 'worst that could happen' (https://therecord.media/cisa-hiring-nick-andersen-warning) The Record • Sep 10, 2026 (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/communications/) Communications +1 more (https://threatbeat.com/section/critical-infrastructure/communications/) Communications | (https://threatbeat.com/section/critical-infrastructure/water/) Water (index.html) Iran hackers after denial of Texas AT&T claim: 'Idiots don't even know what we tampered with' By Bridget Johnson • Sep 10, 2026 (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/communications/) Communications +1 more (https://threatbeat.com/section/critical-infrastructure/communications/) Communications | (https://threatbeat.com/section/critical-infrastructure/water/) Water (https://threatbeat.com/attacks-and-incidents/iran-hackers-claim-texas-att-outage-vow-to-intensify-attacks-before-9-11/) Iran hackers claim Texas AT&T outage, vow to 'intensify' attacks before 9/11 By Bridget Johnson • Sep 09, 2026 (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/energy/) Energy +2 more (https://threatbeat.com/section/critical-infrastructure/communications/) Communications | (https://threatbeat.com/section/critical-infrastructure/energy/) Energy | (https://threatbeat.com/section/critical-infrastructure/water/) Water (https://threatbeat.com/threats/iran-hackers-minnesota-warning-ignored-critical-events-to-hit-3-u-s-infrastructure-sectors/) Iran hackers: Minnesota 'warning' ignored, 'critical events' to hit 3 U.S. infrastructure sectors By Bridget Johnson • Aug 31, 2026 Read More (https://threatbeat.com/adversaries/nato-allies-foil-russian-subsea-cable-sabotage-plot/) () NATO allies foil Russian subsea cable sabotage plot (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/communications/) Communications (https://threatbeat.com/adversaries/nato-allies-foil-russian-subsea-cable-sabotage-plot/) NATO allies foil Russian subsea cable sabotage plot (https://ca.news.yahoo.com/exclusive-nato-allies-foil-russian-060326071.html) Reuters via Yahoo • Sep 10, 2026 (https://threatbeat.com/threats/for-years-they-warned-ai-could-kill-all-humans-now-people-are-listening/) () For years they warned AI could kill all humans. Now people are listening (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology (https://threatbeat.com/threats/for-years-they-warned-ai-could-kill-all-humans-now-people-are-listening/) For years they warned AI could kill all humans. Now people are listening (https://www.washingtonpost.com/technology/2026/09/10/years-they-warned-ai-could-kill-all-humans-now-people-are-listening/) The Washington Post • Sep 10, 2026 (https://threatbeat.com/government-and-industry/cisa-head-says-agency-must-change-quickly-to-prevent-the-worst-that-could-happen/) () CISA head says agency must change quickly to prevent the 'worst that could happen' (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/government/) Government (https://threatbeat.com/government-and-industry/cisa-head-says-agency-must-change-quickly-to-prevent-the-worst-that-could-happen/) CISA head says agency must change quickly to prevent the 'worst that could happen' (https://therecord.media/cisa-hiring-nick-andersen-warning) The Record • Sep 10, 2026 (https://threatbeat.com/attacks-and-incidents/openais-rogue-ai-agents-reached-at-least-12-more-websites-researchers-say/) () OpenAI’s rogue AI agents reached at least 12 more websites, researchers say (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology (https://threatbeat.com/attacks-and-incidents/openais-rogue-ai-agents-reached-at-least-12-more-websites-researchers-say/) OpenAI’s rogue AI agents reached at least 12 more websites, researchers say (https://tech.yahoo.com/ai/articles/openai-rogue-ai-agents-reached-213159425.html) Fortune via Yahoo • Sep 10, 2026 (https://threatbeat.com/government-and-industry/fbi-releases-new-cyber-strategy/) () FBI releases new cyber strategy (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/government/) Government (https://threatbeat.com/government-and-industry/fbi-releases-new-cyber-strategy/) FBI releases new cyber strategy (https://www.ic3.gov/CSA/2026/260909.pdf) IC3 • Sep 09, 2026 (https://threatbeat.com/government-and-industry/anthropic-researcher-quits-over-out-of-control-ai-fears/) () Anthropic researcher quits over ‘out-of-control’ AI fears (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology (https://threatbeat.com/government-and-industry/anthropic-researcher-quits-over-out-of-control-ai-fears/) Anthropic researcher quits over ‘out-of-control’ AI fears (https://www.wsj.com/tech/ai/anthropic-researcher-quits-over-out-of-control-ai-fears-707b7628?mod=hp_lead_pos3) The Wall Street Journal • Sep 09, 2026 (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/government/) Government +2 more (https://threatbeat.com/section/critical-infrastructure/defense-industry/) Defense Industry | (https://threatbeat.com/section/critical-infrastructure/government/) Government | (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology (https://threatbeat.com/government-and-industry/u-s-allies-lack-resources-to-keep-pace-on-ai-top-pentagon-official-says/) U.S. allies lack resources to keep pace on AI, top Pentagon official says (https://www.theguardian.com/us-news/2026/sep/09/us-military-pentagon-allies-ai) The Guardian • Sep 09, 2026 (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology +1 more (https://threatbeat.com/section/critical-infrastructure/government/) Government | (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology (https://threatbeat.com/government-and-industry/u-s-says-alibaba-deepseek-have-systematically-siphoned-ai-models/) U.S. says Alibaba, DeepSeek have ‘systematically’ siphoned AI models (https://www.bloomberg.com/news/articles/2026-09-09/us-says-alibaba-deepseek-have-systematically-siphoned-ai-models) Bloomberg • Sep 09, 2026 (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/government/) Government +1 more (https://threatbeat.com/section/critical-infrastructure/government/) Government | (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology (https://threatbeat.com/government-and-industry/nearly-a-third-of-ai-chatbot-replies-to-voting-questions-inaccurate-outdated-study-says/) Nearly a third of AI chatbot replies to voting questions inaccurate, outdated, study says (https://thehill.com/policy/technology/6071757-ai-chatbots-election-info-inaccuracy/) The Hill • Sep 09, 2026 (https://threatbeat.com/topic/news/) News | (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology (https://threatbeat.com/government-and-industry/un-rights-chief-warns-how-ai-could-pose-existential-risk-to-humanity/) UN rights chief warns how AI could pose ‘existential risk to humanity’ (https://www.euronews.com/next/2026/09/07/un-rights-chief-warns-how-ai-could-pose-existential-risk-to-humanity) Euronews • Sep 09, 2026 (McCrary Institute) Powered by the McCrary Institute at Auburn University (https://mccraryinstitute.com) Learn More Get your cyber briefing Straight from our experts to your inbox (https://threatbeat.com/) Threat Beat Home Social Media Links (https://x.com/McCraryCyber) (X (Formerly Twitter)) X (Formerly Twitter) (https://www.facebook.com/McCraryCyber/) (Facebook) Facebook (https://www.linkedin.com/company/au-mccrary-institute/) (LinkedIn) LinkedIn (https://www.youtube.com/c/McCraryInstitute) (YouTube) YouTube © 2026 Threat Beat (https://threatbeat.com/privacy-policy/) Privacy Policy (https://threatbeat.com/write-for-threat-beat/) Write for Threat Beat (https://threatbeat.com/) Threat Beat Home Close Menu (https://threatbeat.com/section/attacks-and-incidents/) Attacks and Incidents (https://threatbeat.com/section/threats/) Threats (https://threatbeat.com/section/adversaries/) Adversaries (https://threatbeat.com/section/government-and-industry/) Government and Industry (https://threatbeat.com/section/critical-infrastructure/) Critical Infrastructure (https://threatbeat.com/section/critical-infrastructure/agriculture/) Agriculture (https://threatbeat.com/section/critical-infrastructure/chemical/) Chemical (https://threatbeat.com/section/critical-infrastructure/commercial/) Commercial (https://threatbeat.com/section/critical-infrastructure/communications/) Communications (https://threatbeat.com/section/critical-infrastructure/dams/) Dams (https://threatbeat.com/section/critical-infrastructure/defense-industry/) Defense Industry (https://threatbeat.com/section/critical-infrastructure/emergency-services/) Emergency Services (https://threatbeat.com/section/critical-infrastructure/energy/) Energy (https://threatbeat.com/section/critical-infrastructure/financial/) Financial (https://threatbeat.com/section/critical-infrastructure/government/) Government (https://threatbeat.com/section/critical-infrastructure/healthcare/) Healthcare (https://threatbeat.com/section/critical-infrastructure/information-technology/) Information Technology (https://threatbeat.com/section/critical-infrastructure/manufacturing/) Manufacturing (https://threatbeat.com/section/critical-infrastructure/nuclear/) Nuclear (https://threatbeat.com/section/critical-infrastructure/transportation/) Transportation (https://threatbeat.com/section/critical-infrastructure/water/) Water (https://threatbeat.com/section/commentary-and-analysis/) Commentary and Analysis (https://threatbeat.com/topic/policy-brief/) Policy Briefs (https://threatbeat.com/topic/issue-brief/) Issue Briefs (https://threatbeat.com/topic/technical-brief/) Technical Briefs (https://threatbeat.com/section/video/) Video (https://threatbeat.com/threatbase/) Threat Base (https://threatbeat.com/podcast/) Cyber Focus Podcast (https://threatbeat.com/events/) Events (https://threatbeat.com/alerts/) Alerts (https://threatbeat.com/directory/) Team (https://threatbeat.com/projects/) Projects (https://threatbeat.com/cyber-briefing/) Cyber Briefing Follow: Social Media Links (https://x.com/McCraryCyber) (X (Formerly Twitter)) X (Formerly Twitter) (https://www.facebook.com/McCraryCyber/) (Facebook) Facebook (https://www.linkedin.com/company/au-mccrary-institute/) (LinkedIn) LinkedIn (https://www.youtube.com/c/McCraryInstitute) (YouTube) YouTube Click to listen highlighted text! ()