Cyberattacks on U.S. Water Systems Linked to Iran

Executive Summary

A widespread and coordinated campaign of cyberattacks has impacted dozens of municipal water and wastewater systems across the United States. The attacks, which occurred in late July 2026, targeted internet-facing Programmable Logic Controllers (PLCs), which are essential for automated industrial control. Unnamed U.S. officials have indicated that threat actors affiliated with Iran are the primary suspects, aligning with previous federal warnings about Iranian targeting of U.S. critical infrastructure. The attackers successfully compromised systems in at least seven states, including over 30 in Minnesota and nine in Michigan, by exploiting exposed Rockwell Automation PLCs. The intrusions led to operational disruptions, forcing some facilities offline and prompting boil-water advisories. The events have triggered a high-level response from the FBI, CISA, and the EPA, highlighting the systemic risk posed by insecure Operational Technology (OT) in under-resourced utilities.

Threat Overview

The threat actors specifically targeted PLCs that were directly connected to the internet without adequate security controls. By exploiting these devices, they were able to change passwords and IP addresses, effectively locking out legitimate plant operators and disrupting the monitoring and control of water treatment and distribution processes. The primary targets were Rockwell Automation/Allen-Bradley PLCs, though federal agencies have warned that other manufacturers' devices are also at risk.

In Braham, Minnesota, an operator witnessed the intrusion in real-time, leading the city to take its water systems offline as a precaution. Other affected facilities were forced to revert to manual operations to maintain service. While there have been no confirmed instances of water supply contamination, the attacks demonstrate the potential for malicious actors to cause significant physical disruption. The campaign underscores a critical vulnerability in the U.S. water sector, where many small, local utilities lack the resources and expertise to adequately secure their OT environments from sophisticated cyber threats.

Technical Analysis

The attack vector is straightforward but highly effective: direct exploitation of internet-exposed industrial control systems.

Attacker TTPs

• Initial Access: The attackers likely used scanning tools like Shodan to identify vulnerable PLCs exposed to the internet. They gained access via T0886 - Remote Services on the exposed OT devices. This could involve exploiting default credentials or unpatched vulnerabilities.
• Inhibit Response Function: By changing passwords and IP addresses on the PLCs, the attackers executed T0814 - Denial of Service and T0824 - Loss of Control. This action locked out legitimate operators and prevented them from controlling the industrial process.
• Impair Process Control: The primary goal was to disrupt operations. By taking control of the PLCs, the attackers could have manipulated valves, pumps, and chemical dosing systems, representing T0826 - Impair Process Control. Although no contamination was reported, the potential for this impact was high.
• Defense Evasion: The attackers' actions to lock out operators also serve as a defense evasion technique, preventing immediate response and remediation, aligning with T0816 - Modify Controller Tasking.

The suspected link to Iranian state-sponsored actors suggests the motivation may be geopolitical, aiming to demonstrate capability and cause disruption rather than financial gain.

Impact Assessment

The targeting of water utilities, a critical infrastructure sector, carries profound potential consequences for public health and safety.

• Public Safety Risk: The most severe potential impact is the contamination of the public water supply, which could lead to widespread illness or death. While this did not occur, the capability was demonstrated.
• Operational Disruption: Forcing utilities to switch to manual operations is inefficient, error-prone, and unsustainable. It can lead to service disruptions and the issuance of boil-water notices, affecting thousands of residents.
• Economic Impact: Disruption to water service can halt commercial and industrial activities. The costs of incident response, system recovery, and security upgrades can be substantial for already under-funded utilities.
• Erosion of Public Trust: Successful attacks on critical infrastructure can undermine public confidence in the government's ability to provide essential services safely.

These attacks serve as a stark warning of the fragility of essential services when OT systems are not properly secured and isolated from the internet.

IOCs — Directly from Articles

No specific IP addresses, domains, or file hashes were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams at water utilities should hunt for the following to identify at-risk or compromised systems:

Detection & Response

Detection and response in an OT environment require specialized approaches.

1. Asset Inventory and Exposure Analysis: The first step is to identify all internet-facing devices. Use external scanning services and internal asset management tools to find any PLCs, HMIs, or other OT equipment with a public IP address. This is a foundational step for D3FEND Asset Vulnerability Analysis (D3-AVA).
2. Network Traffic Monitoring: Implement OT-aware network monitoring solutions that can parse industrial protocols (e.g., EtherNet/IP, Modbus). Baseline normal communication patterns between PLCs and HMIs and alert on any anomalous activity, such as programming commands from an unauthorized source or connections from the internet. This is a direct application of D3FEND Network Traffic Analysis (D3-NTA).
3. Credential and Configuration Audits: Regularly audit PLC configurations for unauthorized changes to passwords, IP settings, or logic. Alert on any modifications made outside of scheduled maintenance windows.

If a compromise is detected, the immediate priority is to ensure public safety. Isolate the affected systems from the network, revert to manual control if safe and feasible, and engage with federal partners like CISA and the FBI for assistance.

Mitigation

Securing OT environments is paramount to preventing such attacks.

1. Network Segmentation and Isolation: The most critical mitigation is to ensure that no PLCs or other OT devices are directly accessible from the internet. All OT networks should be segmented from IT networks using a firewall or a DMZ. This is a core principle of D3FEND Network Isolation (D3-NI).
2. Secure Remote Access: If remote access to the OT network is required, it must be done through a secure, multi-factor authenticated VPN that terminates in a DMZ, with strict access controls and monitoring for all sessions.
3. Change Default Credentials: Immediately change all default passwords on PLCs, switches, and other network devices. Implement strong, unique passwords for each device.
4. Patch Management: Develop and implement a patch management program for OT systems. While challenging, it is essential to apply security patches for known vulnerabilities in a timely manner, following vendor guidance and testing procedures. This aligns with D3FEND Software Update (D3-SU).