Attacks on Water OT: Over 100 Internet-Exposed Systems Targeted in July

1. Overview

• Title: CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks
• Source: SecurityWeek
• Published: 2026-08-26
• Original Source: SecurityWeek
• Related Resources: CISA Internet Exposure Reduction Guidance
• Related Malware, Threat Groups, CVEs, Products: Iran-linked threat actors (reported attribution for the broader activity), Programmable Logic Controllers, cellular modems, Water and Wastewater Systems OT
• Severity: High

2. Executive Summary

In July 2026, CISA observed malicious activity targeting over 100 internet-exposed systems in the water and wastewater sector. Typical examples include PLCs connected directly to cellular modems. No critical operational disruptions have been reported.

3. Attack Flow

Contact and Attacks on Internet-Exposed OT

1. Threat actors discover Water and Wastewater Systems (WWS) sector systems reachable from the public internet or cellular networks.
2. They target remote management features, such as PLCs connected directly to cellular modems.
3. Public reports do not disclose the specific credentials, vulnerabilities, protocols, commands, or configuration change procedures used.
4. While over 100 systems were targeted, no critical operational disruptions have been confirmed.

4. Threat Actor Location and Execution Point

• External threat actors reaching OT equipment from the public internet or cellular networks.
• The core issue involves configurations that allow direct reachability to PLCs without passing through corporate IT networks.

5. Visibility for Victims and Administrators

Victims

• No critical operational impacts on users, such as widespread water outages or water quality effects, have been reported.

Administrators

• Potential visibility includes incoming connections, login attempts, and configuration or logic changes directed at PLCs and remote management features from the internet or cellular networks.
• Depending on NAT or telecommunication provider configurations, external exposure may not appear in standard asset inventories.

6. Success and Failure Conditions

Success Conditions

• PLCs or management interfaces are directly reachable from the internet or cellular modems.
• Specific weaknesses may exist, such as default or weak credentials, outdated firmware, or unnecessary services. However, the exact exploitation conditions for this incident are not public.
• Lack of OT network monitoring and remote access logging.

7. Failure Conditions and Risk Mitigation

Mitigation

• Remove direct internet exposure and consolidate access behind secure gateways, jump hosts, or VPNs.
• Change default passwords and apply security updates, MFA, allowlisting, and the principle of least privilege.
• Conduct external attack surface discovery scans and continuous OT traffic monitoring.

8. Potential Impact of Success

• Unauthorized access to PLCs/ICS, leading to configuration and logic manipulation, or process halts and disruption.
• Potential physical impacts on water treatment and supply. However, no critical operational disruptions were reported in this incident.
• Continuous re-targeting if the location and operational ownership of internet-exposed OT assets remain unclear.

9. Observable Logs

• Email: Not directly relevant.
• Proxy/SWG/DNS: External access to internet-exposed management interfaces. If OT devices connect directly to cellular networks, corporate proxies will not capture these logs.
• Endpoint/EDR: Because PLCs typically lack EDR, process execution and configuration changes on engineering workstations or jump hosts serve as supporting evidence.
• Identity/IdP: Logins, MFA, and service account usage when routing through VPNs or gateways. Direct PLC connections may bypass IdP visibility.
• SaaS/Cloud: Audit logs for cellular modem management portals, remote access services, and asset management services.
• Network: Internet connections to PLC protocols and management ports, failed and successful logins, configuration or logic downloads, and unusual commands.

10. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed): Over 100 internet-exposed systems were targeted, but public information does not confirm whether authentication or manipulation succeeded on individual systems.
• Malware Execution or Authentication Success Confirmed: Successful unauthorized logins to PLCs or remote management features confirmed via device or gateway logs.
• Subsequent Compromise Confirmed: Confirmed logic or configuration changes, physical process impacts, or lateral movement to engineering workstations.

11. Investigation Playbook

• Trigger: Detection of OT access from the internet or cellular networks, matching CISA's internet exposure reduction guidance, or discovery of unknown PLCs/management interfaces via external scans.
• Initial Verification: Cross-reference asset information, including public IPs, cellular modems, NAT, vendor remote services, and third-party connections. Preserve device/gateway logs, configurations, logic, alarms, and process historian records.
• Endpoints: Check engineering workstations, HMIs, and jump hosts for remote tools, configuration transfers, and credential usage.
• Identity/Cloud: Check accounts, MFA, source IPs, and sessions across VPNs, remote portals, and telecommunication provider management services.
• Post-Exploitation: Check for changes to PLC logic/settings, safety controls, and impacts on water quality, pressure, flow, or lateral movement to IT environments.
• Containment: Immediately remove unnecessary external exposure and consolidate necessary access behind secure gateways or jump hosts. Apply default credential changes, security updates, MFA, and allowlists, and verify physical process states jointly with facility operations personnel.
• Classification: Distinguish between scans/contacts, successful logins, control changes, and physical impacts.

12. Defense and Detection Ideas

• Single Event: Prioritize connections or logins from external internet sources to PLC management ports and industrial protocol ports.
• Timeline Correlation: Correlate external contact, login, configuration/logic transfer, and process alarms/setpoint changes.
• Hunting: Search for internet-exposed OT using external scans and telecommunication provider/vendor asset data in addition to internal CMDBs.
• Log Gaps: PLCs connected directly to cellular networks bypass corporate firewalls and SIEMs; without logs from modems, devices, or OT sensors, contacts cannot be identified.
• Prioritized Countermeasures: Remove direct internet exposure. Implement secure remote access, MFA, and elimination of default credentials. Maintain OT asset inventories, verify external attack surfaces, and monitor networks.

13. Facts / Inference / Hypothesis

Facts

• In July 2026, CISA observed malicious cyber activity targeting over 100 internet-exposed systems in the Water and Wastewater Systems (WWS) sector.
• PLCs connected directly to cellular modems were cited as typical examples.
• SecurityWeek reported that the recent activity is linked to Iran-affiliated threat actors.
• No critical operational disruptions have been reported.
• CISA recommended verifying public assets using asset inventories and external scans, removing unnecessary exposures, changing default passwords, applying security updates, using secure gateways/jump hosts and MFA, and monitoring traffic.

Inference

• Direct connections to cellular networks bypass corporate IT perimeter defenses and SIEM visibility, making them prone to asset management blind spots.
• The targeting of over 100 systems does not imply 100 successful compromises or physical impacts.

Hypothesis

• Because the protocols, credentials, vulnerabilities, and commands used in individual attacks have not been disclosed, specific tactics should not be assumed.

14. MITRE ATT&CK Mapping

Do not perform a high-confidence MITRE ATT&CK mapping based solely on public information.

15. Unknowns and Additional Investigation

• The number of systems among the 100+ that experienced successful logins or control actions, a complete list of targeted states and organizations, and the credentials, vulnerabilities, or protocols used.
• Technical evidence for threat actor attribution and physical process impacts on individual systems.

16. Impact on SOCs

Maintenance cellular routers and vendor remote access can become similar asset management blind spots in industrial OT environments globally. SOCs must cross-reference external scan results with data from facility departments, maintenance vendors, and telecommunication providers, rather than relying solely on IT asset inventories.

17. Target Audience Summary

• For SOCs: Discover PLCs reachable from the internet or cellular networks and categorize them by contact, login, control change, and physical impact stages.
• For Administrators: Remove direct exposures, implement secure gateways and MFA, eliminate default credentials, apply security updates, and monitor OT networks.
• For Users/Operators: No direct user actions are required; the focus lies on exposure remediation and remote access controls managed by facility and network administrators.