Coordinated Cyberattacks Strike OT Systems at Over 30 US Water Utilities

Executive Summary

Between July 27 and August 2, 2026, a series of coordinated cyberattacks targeted the operational technology (OT) systems of over 30 municipal water and wastewater facilities across the Midwestern United States, primarily in Minnesota and Michigan. The attacks resulted in the loss of remote monitoring and control capabilities, forcing several utilities to issue boil water notices and transition to manual operations. Federal agencies, including CISA and the FBI, have activated emergency response teams to assist in containment and recovery efforts while issuing urgent warnings to critical infrastructure operators nationwide.

Threat Analysis

The current campaign demonstrates a high degree of coordination and a focus on soft targets—regional utilities that often lack the robust cybersecurity resources of major metropolitan providers. The threat actors are specifically scanning for and exploiting internet-facing Industrial Control Systems (ICS). By gaining unauthorized access to the human-machine interfaces (HMI) or directly to the hardware, the attackers have been observed modifying device configurations, altering IP addresses to lock out legitimate operators, and changing administrative passwords. This activity aligns with recent warnings regarding state-sponsored groups seeking to demonstrate the capability to disrupt essential services.

Technical Details

Intelligence gathered from the affected sites indicates that the primary targets are internet-exposed Programmable Logic Controllers (PLCs), specifically those using the Modbus TCP protocol and legacy Rockwell Automation MicroLogix series hardware. The attackers utilize automated scanning tools to identify devices with default credentials or those accessible via cellular modems that lack multi-factor authentication (MFA). Once access is gained, a lightweight script is deployed to overwrite the PLC logic registers or change the device’s gateway settings. In the Minnesota cases, the disruption affected automated chemical dosing and filtration timing, triggering safety alarms that necessitated a full system shutdown and switch to manual bypass to maintain water quality standards.

Attribution Assessment

Preliminary forensic evidence and infrastructure analysis suggest the activity is consistent with the 'Cyber Av3ngers' ecosystem, a threat collective frequently attributed to the Iranian Revolutionary Guard Corps (IRGC) Cyber-Electronic Command. The tactics, including the defacement of HMI screens with political messaging and the specific targeting of Israeli-manufactured or commonly used Western industrial hardware, mirror previous Iranian operations. However, some evidence of 'Living off the Land' (LotL) techniques suggests that other actors, including potentially PRC-linked groups like Volt Typhoon, may be leveraging the same vulnerabilities for long-term pre-positioning.

Implications

These attacks represent a significant escalation in the targeting of civilian critical infrastructure. The move from theoretical pre-positioning to active disruption indicates a shift in risk tolerance among state-sponsored actors. For small-to-mid-sized utilities, the cost of remediation and the potential for physical damage to pumps and filtration systems pose a severe operational risk. Furthermore, the reliance on manual operations for extended periods increases the likelihood of human error in maintaining complex water chemistry, posing a long-term public health concern.

Recommendations

1. Immediate Disconnection: Critical infrastructure owners must identify and remove all PLCs and OT devices from the public-facing internet immediately.
2. Secure Remote Access: If remote access is required, it must be facilitated through a secure VPN or a hardware-enforced unidirectional gateway with mandatory MFA.
3. Credential Management: Change all default administrative passwords on ICS hardware and HMI software.
4. Logic Integrity Checks: Operators should perform regular integrity checks of PLC project files against known-good backups to detect unauthorized logic modifications.
5. Segmentation: Implement strict network segmentation between IT and OT environments to prevent lateral movement from compromised business networks.