Coordinated Iranian Hacking Campaign Hits U.S. Water Utilities Across Seven States; CISA Issues Emergency OT Warning

Executive Summary

As of August 3, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI are investigating a significant, coordinated cyber campaign targeting the Water and Wastewater Systems (WWS) sector across at least seven U.S. states. The campaign, which intensified between July 26 and August 1, 2026, has successfully impacted operational technology (OT) at more than 30 facilities in Minnesota and at least nine in Michigan. While water quality remains safe due to rapid manual overrides by local operators, the attackers successfully disrupted remote monitoring and pressure control systems, highlighting critical vulnerabilities in internet-exposed industrial assets and cellular gateways.

Threat Analysis

The current campaign demonstrates a sophisticated understanding of industrial control environments and the limitations of rural infrastructure security. Threat actors are specifically scanning for and exploiting internet-accessible Programmable Logic Controllers (PLCs) and Human-Machine Interfaces (HMIs). The activity is categorized as a "living-off-the-land" OT attack, where adversaries utilize native industrial protocols—such as Modbus TCP and EtherNet/IP—to manipulate process parameters without the need for complex custom malware. By targeting cellular gateways and remote terminal units (RTUs), the actors have successfully bypassed traditional IT-centric security perimeters, focusing entirely on the control plane.

Technical Details

Technical analysis reveals that the attackers are exploiting default credentials and unpatched vulnerabilities in cellular routers used for remote telemetry and SCADA communications. Once access is gained, the actors interact directly with PLCs from several major vendors. Observed tactics include the modification of device IP addresses to lock out legitimate operators, changing setpoints for pump cycles to induce pressure surges, and disabling local alarm systems to mask the intrusion. In some instances, evidence of 'FrostyGoop' modular components was detected, suggesting a hybrid approach of direct protocol manipulation and lightweight OT-specific scripts. The reliance on Port 502 (Modbus) for unauthorized 'Write' commands has been identified as the primary infection vector, allowing for direct register manipulation.

Attribution Assessment

Intelligence gathered by the Minnesota Fusion Center and federal partners strongly suggests the involvement of Iranian-linked threat groups, specifically the IRGC-affiliated persona 'CyberAv3ngers.' The tactics, techniques, and procedures (TTPs) align with previous 2023-2024 campaigns targeting Israeli-made technology and U.S. critical infrastructure. The timing and geographic spread indicate a state-sponsored effort to probe domestic resilience and establish persistence rather than a financially motivated ransomware attack. While some forensic artifacts suggest 'false flag' techniques intended to mimic other state actors, the core C2 infrastructure and targeting patterns point back to established Iranian operational hubs.

Implications

This campaign marks a dangerous escalation in the targeting of small-to-medium utility providers. These entities often lack the specialized OT security staff required to defend against nation-state adversaries. The disruption of monitoring capabilities forces a shift to manual operations, which, while effective for immediate safety, introduces significant operational risk and potential for physical equipment fatigue during extended periods. Furthermore, the successful targeting of multiple states simultaneously suggests a pre-positioning strategy intended for broader disruptive actions during periods of geopolitical tension.

Recommendations

Encrygma recommends the following immediate actions for critical infrastructure operators: 1. Conduct an exhaustive audit of all internet-facing OT assets and remove PLCs/HMIs from the public internet, placing them behind hardened VPNs or zero-trust gateways. 2. Change all default administrative passwords on ICS/SCADA hardware and enforce multi-factor authentication (MFA) for all remote access points. 3. Implement Deep Packet Inspection (DPI) to identify and block unauthorized Modbus TCP 'Write' commands originating from outside the local control network. 4. Formalize and test manual operation protocols to ensure staff can maintain water safety and distribution without digital monitoring systems.