The latest wave of PLC attacks on water utilities has prompted CISA to issue an urgent alert telling every water and wastewater system in the country to pull their programmable logic controllers off the public internet immediately. Iranian-affiliated threat actors have been actively hijacking exposed PLCs, changing their passwords to lock out operators, and altering IP addresses to sever network connections. In at least some cases, the disruptions forced communities into boil water notices and sustained manual operations.
This is the operational consequence of leaving control planes on the public internet, and the same mistake any builder makes when they ship an unauthenticated admin panel on a public IP.
The campaign is not new. CISA, the FBI, NSA, EPA, DOE, and Treasury jointly published advisory AA26-097A on April 7, 2026, attributing the activity to an IRGC-affiliated group known as CyberAv3ngers, also called Shahid Kaveh Group. The July 22 update expanded the scope from Rockwell Automation devices to include Schneider Electric and Siemens PLCs. The July 30 alert narrows the focus to the water sector specifically, where the operational consequences are now hitting the real world. Since at least March 2026, the authoring agencies have identified disruptions through engagements with victim organizations.
What exactly are the attackers doing to these PLCs?
The adversary playbook is straightforward and does not require a zero-day. According to the joint advisory, the attackers used leased third-party hosting infrastructure and manufacturers' own PLC programming software to connect to misconfigured victim PLCs exposed on the internet. They targeted specific ports associated with OT protocols: 44818 for EtherNet/IP, 2222 for Codesys, 102 for S7comm, and 502 for Modbus TCP, along with port 22 for cellular modems.
Once connected, the attackers extracted device project files and then modified or deleted project file logic, including Add-On Instructions. They manipulated data displayed on HMI and SCADA screens. The advisory notes that in some cases, the attackers disabled critical shutdown and alarm logic, allowing systems to enter unsafe conditions without notifying operators of the anomalies.
The July 30 CISA alert adds a more immediate operational wrinkle. Attackers have been changing PLC passwords to lock out legitimate operators and altering IP addresses to disconnect the PLCs from the network entirely. The result is that utilities lose visibility and control of their own treatment processes. When that happens to a water system, the fallback is manual operation, and when manual operation cannot keep up with treatment requirements, boil water notices follow.
Nextgov/FCW reported that the alert came after hacks targeting utilities in Minnesota, where the operational impact became severe enough to trigger the broader warning.
Which devices and ports are in the crosshairs?
The advisory names three vendors and specific PLC families. Rockwell Automation and Allen-Bradley devices include CompactLogix, Micro850, and MicroLogix 1400 controllers. Schneider Electric targets span the BMX P34 and Modicon M340. Siemens S7-1200 series PLCs round out the confirmed list.
The chart above shows the distribution of confirmed targeted PLC models across the three named vendors. Rockwell carries the largest confirmed footprint with 3 models, but the advisory's language is deliberately broad. The agencies warn that potentially all internet-exposed PLCs from these and other manufacturers are at risk.
For defenders, the port list is the actionable artifact. If you see inbound traffic on any of these ports from foreign hosting providers, you should treat it as a potential indicator of compromise.
| Port | Protocol | Primary vendor |
|---|---|---|
| 44818 | EtherNet/IP | Rockwell / Allen-Bradley |
| 2222 | Codesys | Schneider Electric |
| 102 | S7comm | Siemens |
| 502 | Modbus TCP | Schneider Electric (multi-vendor) |
| 22 | SSH | Cellular modems |
The advisory provides downloadable STIX files with IOCs from both the April and July releases. None of these OT protocols have authentication or encryption built in by default. They assume they are operating on a trusted network segment. When you put them on the internet, you are handing the keys to anyone who can find the IP.
Why does this pattern look familiar to anyone running production systems?
If you build and ship software, this story should trigger deja vu. The root cause is unintended internet exposure of a control plane that was designed to sit behind a firewall.
Consider the parallels. A developer spins up a database instance for testing and forgets to restrict the security group. A SaaS company leaves a Redis instance on a public IP with the default password. An OT integrator installs a cellular modem on a PLC for remote maintenance and never documents it. The failure mode is identical in every case: the device trusts the network, and the network is the entire internet.
CISA's alert specifically calls out this undocumented modem problem. Even water organizations with mature cybersecurity processes may have cellular modems installed by operators, vendors, or system integrators that do not appear in routine attack surface scans. These shadow connections are the OT equivalent of the forgotten staging environment with no auth. You cannot defend what you do not inventory.
The Iranian APT group behind this campaign is affiliated with Iran's Islamic Revolutionary Guard Corps Cyber Electronic Command. CISA had previously reported on CyberAv3ngers targeting PLCs, and the current advisory makes clear the campaign has continued and expanded since at least March 2026. This is a sustained targeting operation against US critical infrastructure, and the water sector is feeling the operational consequences first.
For builders, the lesson is about the boundary between the control plane and the internet. Every API endpoint, admin panel, database port, and PLC programming interface that sits on a public IP without mediation is an open door. Shodan and Censys index these services continuously. The question is whether you know your device is there before the attacker does.
What should you do right now if you run OT or exposed control planes?
CISA's mitigation guidance is direct and operators should treat it as a checklist, not a suggestion.
- Disconnect PLCs from the public internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC. If your integrator set up a cellular modem for remote maintenance, find it and put it behind a secure gateway.
- Enable password protection and change every default password. The advisory notes that Rockwell Automation MicroLogix 1400 controllers have specific guidance for restoring access when the password is unknown, which tells you the password-lockout technique is working against real operators.
- Allowlist IPs for remote access. Only known engineering laptops or other critical OT assets should reach the PLC. No broad network access, ever.
- Back up your PLC image. After disconnecting PLCs from the internet, ensure you have a known clean backup. If an attacker has already modified your project files, you need a trusted restore point.
- Hunt for IOCs in your logs. The advisory includes STIX XML and JSON files for both the April and July IOC sets. Look for traffic on ports 44818, 2222, 102, and 502 originating from foreign hosting providers. For Rockwell devices specifically, place the physical mode switch on the controller into run position.
If you find evidence of compromise, contact CISA at 1-844-Say-CISA or [email protected], and reach out to the FBI through IC3 or your local field office. The EPA's Cybersecurity Technical Assistance Program for the Water Sector is also available for utilities that need hands-on support.
For broader context on reducing your attack surface, CISA's Known Exploited Vulnerabilities catalog remains the authoritative source for patched flaws under active exploitation, and our coverage of CISA KEV vulnerabilities at the edge walks through how to operationalize that list for network gear.
How far does the blast radius extend beyond water?
The water sector is the canary here. The advisory explicitly states that the Iranian-affiliated actors targeted devices across multiple US critical infrastructure sectors, including Government Services and Facilities, Water and Wastewater Systems, and Energy. The water sector is getting the attention because the operational impact is immediate and visible: a compromised water treatment PLC can force a boil water notice within hours.
But the same attack pattern works against any internet-exposed PLC, regardless of sector. Manufacturing, energy, food processing, and building automation all run the same Rockwell, Schneider, and Siemens hardware. If you operate OT in any of these environments and you have not validated your external attack surface in the last 90 days, you are flying blind.
The broader industry trend is a slow convergence between IT security practices and OT reality. IT security has spent two decades learning that anything on the public internet will be found and probed within minutes. OT security is learning the same lesson, but the consequences are physical. A compromised web server is a bad day. A compromised water treatment PLC is a public health emergency.
The real fight is at the network edge
The attackers in this campaign are using Shodan, default credentials, and the fact that too many PLCs sit on public IPs. No zero-days required. CISA's alert underscores a visibility and hygiene problem that no amount of threat intelligence will fix. Pull the PLC off the internet. Audit the modems you do not know about. Back up your project files. The rest is detail.
Sources
- CISA: CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
- CISA Advisory AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
- SecurityWeek: CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs
- BleepingComputer: CISA warns of cyberattacks disrupting U.S. water utilities
- Nextgov/FCW: CISA urges water utilities to take exposed systems down after Minnesota hacks
- WaterISAC: CISA Issues Alert Urging Water and Wastewater Utilities to Protect OT Against Activity Targeting PLCs
