Coordinated Cyber Campaign Targets Over 100 US Water and Wastewater Systems

Executive Summary

In a significant escalation of threats against U.S. critical infrastructure, over 100 water and wastewater systems have been targeted in a coordinated cyber campaign. This wave of attacks, identified in early September 2026, focuses on exploiting internet-exposed industrial control systems (ICS) and operational technology (OT) devices. The incidents highlight a persistent vulnerability in the water sector, where legacy hardware remains connected to the public internet, providing an easy entry point for malicious actors.

Threat Analysis

Threat actors are leveraging unsophisticated but highly effective methods to gain unauthorized access to water utility networks. By targeting internet-facing programmable logic controllers (PLCs) and human-machine interfaces (HMIs), attackers are bypassing traditional IT security perimeters. The campaign appears to be a mix of opportunistic scanning and targeted exploitation, likely aimed at pre-positioning for future disruption or conducting reconnaissance on critical operational processes.

Technical Details

Analysis indicates that the attackers are utilizing default credentials and known vulnerabilities in common OT hardware, such as Siemens S7 series PLCs and various Rockwell Automation components. The exploitation chain typically involves:

1. Reconnaissance: Scanning for exposed ports (e.g., Modbus/TCP, HTTP/HTTPS) associated with industrial controllers.
2. Access: Utilizing brute-force attacks or default manufacturer passwords to gain administrative control over the HMI or PLC.
3. Persistence: Deploying lightweight scripts to maintain access and monitor system telemetry.
4. Impact: While many incidents remain in the reconnaissance phase, the potential for manipulating chemical dosing or water pressure remains a primary concern for facility operators.

Attribution Assessment

While no single group has claimed responsibility, the tactics, techniques, and procedures (TTPs) align with recent activity attributed to state-sponsored actors and sophisticated hacktivist collectives. The pattern of targeting internet-exposed edge devices mirrors recent campaigns observed in the energy sector, suggesting a broader, cross-sector strategy to undermine Western critical infrastructure resilience.

Implications

The scale of this campaign underscores the failure of voluntary cybersecurity measures in the water sector. With federal mandates facing legal challenges and funding uncertainty, many smaller utilities remain under-resourced. The risk of a catastrophic failure—such as the contamination of water supplies or prolonged service outages—is at an all-time high.

Recommendations

1. Immediate Exposure Reduction: Disconnect all non-essential ICS/OT devices from the public internet immediately.
2. Credential Hygiene: Enforce strict password policies and replace all default manufacturer credentials on every controller.
3. Continuous Monitoring: Implement OT-specific network monitoring to detect anomalous traffic patterns between IT and OT environments.
4. Incident Readiness: Conduct tabletop exercises focusing on manual override procedures in the event of a total SCADA system compromise.