🚨 CROWDSTRIKE, MINNESOTA & THE WATER-SYSTEM CYBERATTACK
More than 30 Minnesota community water systems were reportedly targeted in a coordinated cyberattack involving operational technology—the PLCs, automated controls and supporting systems governing pumps, pressure, treatment, storage and distribution.
Before the complete forensic evidence was released publicly, investigators began pointing toward “Iranian-affiliated” hackers.
Why?
President Trump publicly rejected that attribution:
“I don’t think there was an Iranian cyberattack. I think that Minnesota ought to get its act together.”
That disagreement raises the fundamental question:
Who first attributed this operation to Iran—and what forensic evidence supported that conclusion?
Let’s take a deeper look.
THE CROWDSTRIKE–MINNESOTA CONNECTION
Minnesota’s statewide Managed Detection and Response program uses CrowdStrike.
Yes, seriously.
Through MNIT’s Whole-of-State Cybersecurity Program, CrowdStrike technology protects more than 55,000 computers and servers across over 200 Minnesota cities, counties, schools, tribal governments and other public entities.
CrowdStrike was co-founded by Dmitri Alperovitch, a Russian-born American cybersecurity executive who later became deeply involved in US national-security policy.
Alperovitch has served as:
• A special adviser to the Department of Defense
• A member of the Homeland Security Advisory Council
• A member of CISA’s Cyber Safety Review Board
• Founder of the national-security policy organization Silverado Policy AcceleratorCrowdStrike Services is led by Shawn Henry, the former executive assistant director of the FBI’s Criminal, Cyber, Response and Services Branch.
This is not simply an antivirus company.
CrowdStrike operates at the intersection of private cybersecurity, federal law enforcement, intelligence attribution, national-security policy and political power.
CROWDSTRIKE, THE DNC AND RUSSIAGATE
CrowdStrike became internationally prominent after the Democratic National Committee hired it to investigate the 2016 DNC network intrusion.
CrowdStrike attributed the operation to Russian intelligence.
Instead of independently examining the original DNC servers, federal investigators relied heavily upon CrowdStrike’s forensic findings and reports.
A document declassified in 2025 by DNI Tulsi Gabbard added another layer to this relationship.
The document contained communications associated with Leonard Benardo of George Soros’s Open Society Foundations, discussing CrowdStrike as one of the resources that could be used to obtain information or “media” concerning Trump as Hillary Clinton’s campaign moved forward with the Russia narrative.
I am sure this is all a coincidence.😂
CROWDSTRIKE, UKRAINE AND TRUMP’S IMPEACHMENT
CrowdStrike appeared again during the July 25, 2019 telephone call between President Trump and Ukrainian President Volodymyr Zelensky—the conversation that became central to Trump’s first impeachment.
According to the official transcript, Trump said:
“I would like you to find out what happened with this whole situation with Ukraine, they say Crowdstrike… The server, they say Ukraine has it.”
Trump’s question reflected a much larger dispute:
• Who possessed the original evidence from the DNC intrusion?
• Who conducted the forensic examination?
• Why did the FBI rely so heavily upon a private contractor?
• What information concerning CrowdStrike or the DNC operation potentially existed in Ukraine?
• Who controlled the evidence used to construct the Russia-attribution narrative?
Those questions were buried beneath the impeachment spectacle.
Now we discover that Minnesota was relying upon the same company during one of the largest coordinated cyberattacks reported against American water systems—while at the same time grand juries are reportedly examining organizations and activities connected to the broader Russiagate operation.
Is that merely a coincidence? I don’t think so.
Let’s do a closer examination of who had access, who controlled the evidence and who shaped the attribution…
THE ISRAEL–UKRAINE INTELLIGENCE BRIDGE
This is where the larger geopolitical map begins to take shape.
Israel and Ukraine have increasingly convergent security interests centered on the Russia–Iran partnership.
Russia has used Iranian-designed Shahed drones extensively against Ukrainian cities and infrastructure.
Ukraine possesses:
• Recovered Iranian-designed drones
• Battlefield telemetry
• Electronic signatures
• Flight and targeting data
• Russian operational information
• Thousands of real-world encounters with Iranian technologyIsrael possesses:
• Extensive intelligence concerning Iran
• Signals-intelligence capabilities
• Technical knowledge of Iranian weapons
• Intelligence on Iranian procurement networks
• Decades of operations directed against Iranian military capabilitiesUkraine requested Israeli intelligence concerning Iran’s support for the Russian military in 2022.
Zelensky later confirmed that Israel was providing intelligence about Iranian drones.
Israeli President Isaac Herzog publicly displayed evidence connecting drones recovered in Ukraine to Iranian models and described that evidence as only the “tip of the iceberg” of the available intelligence.
That creates a direct intelligence feedback loop:
Iranian technology flows to Russia.
Russia deploys it against Ukraine.Ukraine collects battlefield evidence.
Israel contributes intelligence about the Iranian systems and networks.
Ukraine and Israel jointly expand their understanding of Iranian military capabilities.
The relationship is not hypothetical. It is documented.
THE MILITARY CONNECTION
Israel initially resisted providing Ukraine with major offensive weapons and Iron Dome because Israel needed to preserve its freedom of operation around Russian forces in Syria.However, military and security cooperation continued developing through:
• Israeli missile-and-drone warning technology for Kyiv
• Civil-defense and emergency-management cooperation
• Intelligence concerning Iranian drones
• Ukrainian analysis of Iranian weapons
• Israeli humanitarian and battlefield medical assistance
• Discussions about transferring Russian weapons captured by Israel
• The reported movement of retired Israeli Patriot equipment through the United States for Ukrainian useUkraine’s battlefield experience with Iranian drones is extremely valuable to Israel.
Israel’s intelligence concerning Iran is extremely valuable to Ukraine.
Russia and Iran cooperate.
Ukraine and Israel consequently have a shared interest in countering both.
THE POLITICAL CONNECTION
The political relationship operates at several levels.Zelensky and Netanyahu have maintained direct communications concerning:
• Civil defense
• Missile and drone threats
• Intelligence cooperation
• Ukrainian sovereignty
• Israeli security
• Iran
• Russia
• US military and political supportRecently, Benjamin Netanyahu and Zelensky were both in Washington during the same general period.
That followed Laura Loomer’s interview with Zelensky.
Who connected those circles? I wonder…
Was it merely media outreach, or are political intermediaries coordinating communications between the Ukrainian, Israeli and American political establishments?
The United States serves as the central hub connecting both governments through weapons, intelligence, cybersecurity, cloud infrastructure, sanctions policy and political support.
For the current event in Minnesota the relationship can be mapped like this:
MINNESOTA GOVERNMENT
↓
CROWDSTRIKE AND US CYBER CONTRACTORS
↓
FBI, DHS, CISA AND NATIONAL-SECURITY POLICY NETWORKS
↓
ISRAELI CYBERSECURITY AND UNIT 8200 ECOSYSTEM
↓
ISRAEL–UKRAINE INTELLIGENCE COOPERATION
↓
SHARED FOCUS ON RUSSIA AND IRAN
↓
ATTRIBUTION OF THE MINNESOTA ATTACK TO “IRANIAN-AFFILIATED” ACTORSTHE UKRAINIAN POLITICAL-BUSINESS LAYER
There is also a private political and oligarchic connection.Ukrainian-Israeli oligarch Ihor Kolomoisky owned the television network that broadcast Zelensky’s programs and helped establish his national political profile.
Kolomoisky reportedly held Israeli citizenship and lived in Israel during periods of political and legal pressure in Ukraine.
Zelensky denied being controlled by Kolomoisky, and his government later moved against the oligarch.
Nevertheless, Kolomoisky represents an important bridge between:
• Ukrainian politics
• Israeli residency and citizenship networks
• Ukrainian media
• Banking and private capital
• Zelensky’s political rise
• American political intermediariesThat does not exist in isolation.
It is part of a broader transnational network where political influence, intelligence relationships, financial interests, private technology companies and national-security operations repeatedly overlap.
REPORTS OF UKRAINIAN INTELLIGENCE OPERATIONS
Reports also recently claimed that Ukrainian intelligence personnel were operating in Iraq and working with militia groups to manufacture false-flag operations against the Iraqi government.That same Iraqi government had recently come to Washington, met with President Trump and negotiated major energy-infrastructure agreements.
If those reports are accurate, several questions follow:
• Who authorized the Ukrainian operation?
• What interests would benefit from destabilizing the Iraqi government?
• Would destabilization threaten the energy agreements reached with Trump?
• Did Israeli, Ukrainian or Western intelligence services possess advance knowledge?
• Was Iran intended to receive the blame?
• Would the resulting escalation benefit actors seeking a broader confrontation with Iran?
That alleged operation must be examined alongside the Minnesota cyberattack—not because they are automatically the same operation, but because the geopolitical incentives and attribution patterns may overlap.
CROWDSTRIKE’S ISRAELI CYBERSECURITY NETWORK
CrowdStrike has also become increasingly integrated with Israel’s cybersecurity industry.By 2026, its Israeli acquisitions included:
• Preempt Security
• Bionic
• Flow Security
• Adaptive Shield
• Seraphic SecurityThese acquisitions mean that Israeli-developed technology, Israeli cybersecurity personnel and Israeli research-and-development teams contribute directly to CrowdStrike’s larger platform.
CrowdStrike therefore sits inside several overlapping systems:
• Minnesota government cybersecurity
• US federal intelligence and law enforcement
• Democratic Party political operations
• Russiagate attribution
• Ukrainian political controversy
• Israeli cybersecurity development
• US national-security policymakingThat makes CrowdStrike more than a passing detail in the Minnesota story.
WHAT DID CROWDSTRIKE ACTUALLY PROTECT?
There is currently no public confirmation that CrowdStrike was installed directly on the specific operational technology attacked at Minnesota’s water facilities.CrowdStrike primarily protects conventional endpoints:
• Employee computers
• Windows and Linux servers
• Credentials and user accounts
• Enterprise networks
• Malware and ransomware entry pointsThe Minnesota attack reportedly involved operational technology, potentially including:
• Programmable logic controllers
• SCADA systems
• Human-machine interfaces
• Remote telemetry equipment
• Pump and pressure controls
• Vendor remote-access gatewaysIf attackers connected directly to exposed PLCs, they could potentially bypass CrowdStrike-protected municipal computers entirely.
That makes the contractor, network and equipment records critical.
THE ISRAELI CRITICAL-INFRASTRUCTURE CYBER ECOSYSTEM
There is another layer.
The COVID-19 Cyber Threat Intelligence League—CTI League—was established in March 2020 as an international volunteer cybersecurity organization.
One of its four founders was Ohad Zaidenberg, an Israeli cybersecurity researcher and former commander in Unit 8200—Israel’s military signals-intelligence and cyber unit.
CTI League offered pro-bono cybersecurity assistance to:
• Hospitals
• Pharmaceutical companies
• Law enforcement
• Federal agencies
• State and local governments
• Critical-infrastructure operators (Water, Nuclear, Grid)It partnered with CISA and Health-ISAC while generally withholding the identities of facilities receiving assistance.
CTI League was not technically an Israeli company.
Nevertheless, its Unit 8200 connection and access to American critical infrastructure are directly relevant when mapping the relationships between intelligence, government and private cybersecurity organizations.Several major operational-technology security companies also originated within Israel’s military-intelligence and cybersecurity ecosystem:
• Claroty was launched through Team8. Its early president, Nadav Zafrir, previously commanded Unit 8200.
• CyberX was founded by Omer Schneider and Nir Giller, both veterans of an elite Israeli cyber-intelligence unit.
Microsoft acquired CyberX and incorporated its technology into Microsoft Defender for IoT.
• Indegy was an Israeli industrial-cybersecurity company acquired by Tenable.
Its technology became part of Tenable OT Security.
• Waterfall Security Solutions is headquartered in Israel and specializes in water, energy, nuclear and other critical infrastructure.
• Armis, SCADAfence, Radiflow and OTORIO were also created within Israel’s cybersecurity ecosystem.
A substantial portion of the technology protecting Western industrial infrastructure was developed by personnel who previously worked inside Israel’s military-intelligence system.
That relationship deserves transparency—especially when cybersecurity attribution could be used to influence decisions involving war.
THE COMPANIES CONFIRMED WITHIN MINNESOTA
CrowdStrike:
MNIT’s Whole-of-State Managed Detection and Response provider, protecting more than 55,000 government endpoints across over 200 public entities.
Tenable Security Center:
Used by MNIT for vulnerability scanning, including limited scanning of IoT and industrial-control devices.
Tenable acquired Israeli operational-technology company Indegy.
Tenable co-founder Ron Gula previously worked at the NSA.
Former Tenable CEO Amit Yoran graduated from West Point, served as an Air Force officer and became the founding director of DHS’s National Cyber Security Division.
Check Point CloudGuard:
An Israeli cybersecurity platform used by Minnesota agencies for cloud and web-application protection.
Check Point founders Gil Shwed and Shlomo Kramer came from Israel’s Unit 8200 military-intelligence environment.
Microsoft:
Broadly used across Minnesota government.
Microsoft acquired Israeli operational-technology company CyberX and incorporated it into Defender for IoT.
Microsoft also operates at the center of US military cloud infrastructure, Ukrainian cyber defense and Israeli cybersecurity development.Amazon Web Services:
Provides cloud infrastructure and related security services to Minnesota agencies.
AWS also operates classified infrastructure for the CIA and provides cloud services across the Department of Defense.
F5:
Used by Minnesota agencies for web-application firewall and cloud-security functions.Akamai:
Used for web-application protection and DDoS-related services and connected to the Israeli cybersecurity industry through multiple acquisitions.
THE COMPLETE NETWORK
The complete network is therefore not simply:Minnesota → CrowdStrike.
It is:
MINNESOTA PUBLIC INFRASTRUCTURE
↓
MNIT WHOLE-OF-STATE CYBERSECURITY
↓
CROWDSTRIKE, TENABLE, CHECK POINT, MICROSOFT, AWS, F5 AND AKAMAI
↓
FBI, DHS, CISA, NSA, CIA AND DEPARTMENT OF DEFENSE RELATIONSHIPS
↓
ISRAELI UNIT 8200 VETERANS AND CYBERSECURITY COMPANIES
↓
UKRAINIAN CYBERSECURITY, POLITICAL AND INTELLIGENCE NETWORKS
↓
ISRAEL–UKRAINE COOPERATION AGAINST RUSSIA AND IRAN
↓
AN IRANIAN ATTRIBUTION FOLLOWING THE MINNESOTA WATER ATTACKThat does not look like a collection of random, isolated coincidences.
It looks like a tightly interconnected cybersecurity, intelligence and political ecosystem whose members possess access to infrastructure, control enormous amounts of security telemetry and influence how attacks are attributed to foreign governments.
THE QUESTIONS MINNESOTA MUST ANSWER
• Which affected municipalities participated in Minnesota’s CrowdStrike program?• Was CrowdStrike deployed only on office computers, or also on SCADA-supporting servers?
• What telemetry did CrowdStrike collect before, during and after the attack?
• Which manufacturers supplied the compromised PLCs?
• Which engineering and SCADA contractors maintained remote access?
• Were default passwords, exposed controllers or known vulnerabilities left uncorrected?
• Did Tenable or another vulnerability platform scan these systems before the attack?
• Which Israeli-developed cybersecurity products were present within the affected environments?
• Did any contractors employ personnel with foreign military or intelligence backgrounds?
• Who first classified the operation as Iranian?
• What organization created the original attribution report?
• Did MNIT, the Minnesota Fusion Center, WaterISAC, CISA and the FBI independently verify the conclusion—or repeat the same preliminary assessment?
• Did Israeli or Ukrainian intelligence provide any information used in the attribution?
• Who possesses the original logs, controller files, malware samples and forensic images?
• Were alternative attribution theories examined?
• Why did President Trump publicly reject the Iran attribution?
CYBER ATTRIBUTION IS NOT MAGIC
IP addresses can be routed.
Servers can be rented.
Infrastructure can be compromised.
Malware can be copied.
Foreign-language artifacts can be planted.
Previously identified techniques can be imitated.Intelligence assessments can be selectively circulated.
Private contractors can shape the evidence presented to government officials.
A cyber operation can resemble Iranian activity without proving that the Iranian government ordered or conducted it.
Iran possesses the capability and motive to target American infrastructure.
The real question is narrower:
Does the forensic evidence prove Iran conducted this particular attack—or did “Iran” become the preferred explanation because it matched a geopolitical narrative already waiting for confirmation?
Why would President Trump say he did not believe Iran conducted the attack?
Perhaps because the administration possesses information Minnesota officials do not.
Perhaps because the attribution was premature.
Or perhaps because the operation was designed as a false flag intended to build public support for escalating the conflict with Iran.
My assessment is that this is the first of many more to come that will be blamed on Iran or Russia.
Israel and Ukraine’s objectives in these wars are not the same as President Trump’s. This has been stated publicly.
Both countries want major escalations and control of territories at the same time that Trump is deescalating and attempting to end them.
Motive, Intent and Capability…
Follow the access.
Follow the contracts.
Follow the intelligence relationships.
Follow the attribution chain.
— @realjoshuareid Jul 31, 2026
My News LinksMy News Links - Articles and Tweets