Iranian hackers pushed back after Wednesday’s denial of their claim that they hit AT&T service in major Texas cities on Labor Day, declaring that those rebuffing their claim “don’t even know what we tampered with” or “have access to.”

APT IRAN, which threatened at the end of August that “critical events” will hit three U.S. critical infrastructure sectors including telecommunications following the water hacks in Minnesota and elsewhere, claimed in a Tuesday post on their Telegram channel that they were behind the AT&T outage and breached an unnamed water utility in the Lone Star State.

The Houston Chronicle reported that users began reporting AT&T issues at Downdetector on Sunday, with a “massive surge of reported outages” reported after noon on Labor Day. “The largest cluster of outages reported came from the Houston area, followed by Spring, Dallas, Fort Worth, Cypress and Austin,” the outlet reported. “More than 40 percent of reported outages cited problems tied to 5G home internet.”

APT IRAN, which is closely linked to the Islamic Revolutionary Guard Corps-affiliated CyberAv3ngers and has previously focused on operational technology targets, posted a statement on their Telegram channel Tuesday evening Eastern time taking credit for the outage.

“We have attacked telecommunications and other critical infrastructure in Texas, including disrupting AT&T internet service in Houston, Dallas, Austin, and San Antonio, and we have also penetrated a water utility in Texas, disrupting water service,” the APT IRAN statement said.

“The American people, you know who is responsible for these disruptions!” the group added. “Trump’s adventures have allowed these attacks to continue and will intensify until September 11th, we will show you what is happening.”

An AT&T spokesman said “we have no evidence to support” the claim made by APT IRAN. “Our assessment indicates that attempted cable theft led to the outage,” the spokesman said. “Internet service across Dallas and surrounding areas is operating normally, and we continue to monitor our network and review relevant information.”

On Wednesday afternoon Eastern time, after the telecom company’s statement, APT IRAN released a post on their Telegram channel that referenced an excerpt from their “message to the United States and the American People” posted on Sept. 4: “From this moment on, any disruption, disruption or instability in infrastructure, etc., regardless of its scale and duration, must be assessed within the framework of a new phase of confrontation and mutual pressure between the United States and Iran, because the rules of the game have changed.”

“Oh yes, we warned on this date and we are still saying it,” APT IRAN said Wednesday. “This is so ridiculous that a country that claims to own everything in cyberspace is now resorting to lies and honeypots!”

“You know what’s the funniest thing?” the hacking group added. “That those idiots don’t even know what we tampered with, what we have access to, and what things were disrupted!”

The latest statement didn’t mention AT&T or any other alleged target by name.

There have been no known public reports about recent breaches of water systems in Texas. A short video accompanying APT IRAN’s Tuesday claim showed “HACKED_BY_APT_IRAN” and “HACKED_BY_CyberAv3ngers” being added to the “programs” file in an unknown system. The beginning of a system name ending with “PLC1” was blacked out by a gray bar.

The Cybersecurity and Infrastructure Security Agency “urgently” warned critical infrastructure organizations in July of “ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs).” On Aug. 31, the Trump administration said Texas would be the first state in a pilot program to assist water utilities with cybersecurity.

APT IRAN claimed in a mid-August statement that they conducted the end-of-July hacks on the water systems of dozens of communities “only to warn” of their broader capabilities to strike U.S. critical infrastructure. “The infrastructure of electricity, telecommunications, water, and anywhere in America that you think is under our control, and whenever America acts arrogantly, we will press the button,” the group later added on Aug. 23, claiming they had targeted water systems in Minnesota, Michigan, Georgia, New Jersey, South Dakota and Arkansas.

OSINT EVERY MORNING IN YOUR INBOX: Subscribe

On Aug. 30, the group declared in a Telegram message, “Soon, the United States will witness unexpected and critical events in the energy, water, and telecommunications industries.”

“We had previously warned that anyone who encroaches on this soil and threatens our beloved Iran will pay for this mistake with their lives,” APT IRAN’s threat continued. “You ignored our warnings, and we in Minnesota warned you again. You ignored them again; but this time we will sew the lips and mouths of the American people together.”

Last week, APT IRAN doubled down on recent threats to launch more attacks on U.S. critical infrastructure sectors, vowing that “the American people will face numerous problems” in response to a Sept. 1 missile strike that hit a wedding in Kuhestak. 

“Self-defense” in response, the hacking group said, “may take the following forms: A few days of no drinking water, disruptions to mobile phone and internet networks, disruptions to energy, gas and electricity infrastructure.”

The Washington Post reported Saturday that “the Pentagon is investigating the high likelihood that an explosion in southern Iran that destroyed a home hosting a wedding celebration was caused by a U.S. bomb that missed a nearby target.”

Iranian hacking groups have declared a focus on U.S. infrastructure targets since the war began. At the end of March, APT IRAN and Handala, which is also affiliated with the IRGC, issued a unified infrastructure threat in conjunction with CyberAv3ngers.

“Previous experience has shown that this warning is testable and incidents have occurred in the past for the water infrastructure of the United States,” APT IRAN said in a March 27 post on the group’s Telegram channel. “Therefore, it is emphasized to refrain from threatening the water infrastructure of Iran.”

“If this warning is not heeded, irreparable damages will be inflicted on the other side,” it concluded.