US State Department Posts $10M Bounty on IRGC CEC Commander Amir Yaryab for Directing Attacks on 100+ Water Utilities

The reward targets Yaryab's oversight of CyberAv3ngers, Dadeh Afzar Arman, and Shahid Hemmat units, which deployed custom malware against energy, shipping, and defense networks in the US, Europe, and Middle East. Treasury sanctions and prior DOJ indictments document command-and-control infrastructure tied to these clusters, including domains used in the 2023-2024 water sector intrusions. Official statements list specific sectors hit but omit CVE-level indicators or packet captures, creating a gap between attribution claims and publicly verifiable technical evidence.

Previous $10 million rewards for CyberAv3ngers operators and the recent Labor Department and FERC email breaches show a consistent pattern of IRGC-linked activity coinciding with US-Iran tensions. Procurement records reveal increased CISA funding for sector-specific monitoring, yet no independent third-party confirmation of Yaryab's personal role has surfaced beyond US government assertions. The scale of the bounty functions as both intelligence-collection tool and deterrent signal.

Contract awards and job postings at IRGC-linked entities indicate continued investment in electronic warfare capabilities, suggesting operations will persist. Water utilities remain soft targets due to legacy SCADA systems and limited segmentation. Expect additional sanctions designations and possible indictments as agencies cross-reference the same malware samples already flagged in earlier alerts.

Next steps include expanded CISA advisories and potential new reward notices if fresh compromises surface in the energy or transportation sectors within the next quarter.