Threat reportICS/SCADATL-2026-1337
Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause Harmful Interference to Utility Fixed Microwave Links, Threatening Grid SCADA and Public-Safety Communications
Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause (TL-2026-1337), also tracked as 6 GHz LPI Wi-Fi interference to utility microwave, is a high-severity ICS/SCADA threat, first published 2026-07-14. It has no confirmed attribution, affects Multiple (FCC-certified consumer electronics manufacturers) Unlicensed, maps to 15 MITRE ATT&CK techniques (T0813, T0814, T0815), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-1337
- Threat ID
- TL-2026-1337
- Also known as
- 6 GHz LPI Wi-Fi interference to utility microwave, Fortson-Columbus 6 GHz interference test
- Severity
- HIGH
- Status
- ACTIVE
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- energy, utilities, government administration, public-safety, telecoms
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 17
How Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause works
Field testing by Southern Company Services, Lockard & White, and the Electric Power Research Institute (EPRI) near a Southern Co. 6 GHz fixed microwave link between Fortson and Columbus, Georgia found that a single FCC-certified, unlicensed, commercially available Low-Power Indoor (LPI) Wi-Fi device produced enough constant interference to disable the utility communications link for tens of hours per year, versus a design/reliability standard of roughly five minutes annually. Southern Co. reported the results to the FCC on June 23, 2026 (filing 106231367519302), and a coalition led by NRECA, EEI, APPA, and UTC has asked the FCC to halt further certification of unlicensed 6 GHz devices pending independent, real-world coexistence testing.
The 6 GHz band (5.925-7.125 GHz) was opened by the FCC in April 2020 for unlicensed sharing with incumbent licensees, chiefly electric-utility, public-safety, and telecom fixed point-to-point microwave links that carry SCADA telemetry, grid-protection signaling, advanced metering infrastructure (AMI) backhaul, and first-responder communications. The FCC's coexistence framework relies on two device classes and one automated safeguard: Low-Power Indoor (LPI) devices, which operate license-exempt at reduced power with no location-awareness requirement, and Standard-Power / the newly proposed Geofenced Variable Power (GVP) devices, which must query an Automated Frequency Coordination (AFC) system built on the FCC's Universal Licensing System (ULS) incumbent database to avoid transmitting inside a software-defined exclusion zone drawn around each licensed link's beam path.
Field testing conducted by Southern Company Services, engineering firm Lockard & White, and EPRI physically validated what utility trade groups had argued analytically for years: LPI devices, which are exempt from any AFC check and are already sold at retail as ordinary routers, laptops, and cellphones, can and do cause harmful interference to licensed fixed microwave receivers when operated near a link's path. In the Fortson-Columbus, Georgia test, a single such device produced near-constant interference that took the monitored microwave link out of service for a cumulative total of tens of hours annually, roughly two orders of magnitude beyond the ~5-minutes-per-year unavailability standard that utility microwave networks are engineered to meet for SCADA and protective-relay traffic. Southern Co. filed the results with the FCC on June 23, 2026 under filing 106231367519302.
This interference risk is compounded by two structural gaps in the FCC's coexistence design. First, LPI devices are entirely outside the AFC/exclusion-zone protection scheme that governs Standard-Power and proposed GVP devices, so no database check or geofencing prevents an LPI unit from transmitting adjacent to a protected microwave receiver. Second, even for AFC-governed device classes, security researchers have published a GPS-spoofing attack (arXiv:2509.02824) against the location self-reporting used to place a device inside or outside an exclusion zone: an attacker with access to a Standard-Power/GVP access point can spoof its GPS-derived location to the AFC system, causing it to transmit at full power inside a zone the AFC believes is unoccupied, or evade detection as a 'rogue' outdoor access point — a threat vector Aviat Networks separately flags as 'extremely difficult to detect and resolve.' On January 7-8, 2026 the FCC announced it will vote on an Order creating the new GVP device category (up to 24 dBm EIRP) to further expand unlicensed 6 GHz use, over utility- and public-safety-sector objections that the AFC/ULS database is 'often seen to contain inaccurate or outdated location and antenna data,' undermining the exclusion-zone protections GVP depends on.
More than 40,000 licensed 6 GHz fixed-microwave links are deployed across the US, used for cellular backhaul, utility SCADA/telemetry, and public-safety/first-responder communications. On January 26, 2026, NRECA joined EEI, UTC, and APPA in a formal letter urging the FCC to immediately pause further certification of unlicensed 6 GHz LPI devices until rigorous, independent coexistence testing is completed, noting that LPI device manufacturers have refused to participate in or make devices available for such testing while simultaneously seeking FCC certification. The coalition is also asking the FCC to establish a cost-recovery mechanism so licensed utility operators can recoup the cost of identifying and mitigating interference once it occurs. This follows a 2020 legal fight in which utility groups (UTC, EEI, APPA) petitioned the FCC and later litigated in AT&T Services, Inc. v. FCC (D.C. Cir., No. 20-1190) seeking stronger 6 GHz protections for incumbent licensees; the D.C. Circuit declined to stay the FCC's rules on December 28, 2020.
This is not an exploit, malware, or threat-actor campaign: there is no CVE, no CVSS score, no confirmed malicious intent, and no attribution. It is a verified, real-world radio-frequency coexistence failure with direct operational-technology and public-safety consequences — degraded or lost SCADA visibility/control and protective-relay signaling on licensed utility microwave links — arising from ordinary, FCC-certified consumer electronics operating exactly as their unlicensed authorization permits. It is documented here because the operational impact (loss of grid monitoring/control-channel availability) is materially identical to a wireless denial-of-service condition against ICS communications, and because the disclosed GPS-spoofing attack against AFC location-reporting is a genuine, exploitable weakness in the regulatory mitigation that utilities are being asked to rely on.
MITRE ATT&CK techniques used in TL-2026-1337
Impact
T0813 Denial of Control; T0815 Denial of View; T0826 Loss of Availability; T0827 Loss of Control; T0829 Loss of View; T0837 Loss of Protection; T0880 Loss of Safety
Inhibit Response Function
T0814 Denial of Service; T0878 Alarm Suppression
Collection
Initial Access
inhibit-response-function
T1691.001 Command Message; T1691.002 Reporting Message
Impair Process Control
evasion
Affected products and versions in Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause
- Multiple (FCC-certified consumer electronics manufacturers) — Unlicensed 6 GHz Low-Power Indoor (LPI) Wi-Fi devices (routers, laptops, cellphones)
Vulnerable versions: All FCC-certified LPI devices operating per current Part 15 6 GHz rules - FCC (regulatory framework) — Automated Frequency Coordination (AFC) system for Standard-Power / proposed Geofenced Variable Power (GVP) 6 GHz devices
Vulnerable versions: AFC location self-reporting as currently specified; ULS incumbent database with reported inaccurate/outdated link location and antenna data
Remediation for Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause
Immediate actions
- Inventory all licensed 6 GHz fixed-microwave links used for SCADA, protective-relay, AMI backhaul, or public-safety traffic and confirm their exclusion-zone registration is current in the FCC Universal Licensing System (ULS).
- Monitor licensed 6 GHz links for anomalous outage/error-rate patterns consistent with intermittent interference rather than hardware or path failure, and correlate outage timing with nearby unlicensed 6 GHz device deployment (residential, commercial, retail).
- File interference reports with the FCC (as Southern Company Services did under filing 106231367519302) whenever LPI-device interference is confirmed, to build the evidentiary record utility coalitions are using to seek a certification pause.
Workarounds
- Where feasible, request or negotiate physical separation/shielding between LPI-capable consumer Wi-Fi deployments and known utility microwave receive sites near the link path.
Longer-term hardening
- Evaluate migration of critical SCADA/protective-relay microwave links away from the shared 6 GHz band to licensed bands not subject to LPI/GVP unlicensed sharing (e.g., 11 GHz), as recommended by microwave-link vendors such as Aviat Networks.
- Deploy link diversity/protection (e.g., multi-band Layer-1 link aggregation combining 6 GHz with an unshared band) so a single interference event cannot take a protective or SCADA circuit fully out of service.
- Participate in NRECA/EEI/APPA/UTC coalition FCC filings and comment proceedings advocating for LPI device coexistence testing, AFC coverage for LPI devices, and a cost-recovery mechanism for interference remediation.
Timeline of Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause
- FCC adopts rules opening the 6 GHz band (5.925-7.125 GHz) to unlicensed use on a shared basis with incumbent fixed-microwave, CTRS, and BAS licensees.
- Utilities Technology Council, Edison Electric Institute, and American Public Power Association petition the FCC and pursue litigation seeking stronger interference protections for incumbent 6 GHz microwave licensees.
- U.S. Court of Appeals for the D.C. Circuit declines to stay the FCC's 6 GHz unlicensed-use rules in AT&T Services, Inc. v. FCC (No. 20-1190).
- FCC issues further fact sheet/rulemaking activity on unlicensed use of the 6 GHz band.
- FCC issues fact sheet expanding unlicensed 6 GHz use (Very Low Power device category).
- Federal Register publishes rule expanding flexible unlicensed use in mid-band spectrum between 3.7 and 24 GHz, covering the 6 GHz band.
- FCC Chairman Brendan Carr announces the Commission will vote on an Order creating a new Geofenced Variable Power (GVP) unlicensed 6 GHz device category (up to 24 dBm EIRP).
- NRECA, joined by EEI, UTC, and APPA, sends a letter urging the FCC to immediately pause further certification of unlicensed 6 GHz LPI devices pending rigorous, independent coexistence testing.
- Southern Company Services, Lockard & White, and EPRI conduct field interference testing near Southern Co.'s 6 GHz fixed microwave link between Fortson and Columbus, Georgia (month reported as April; exact day not disclosed in public reporting).
- Southern Company Services files the interference test results with the FCC (filing 106231367519302), confirming a single LPI device caused tens of hours per year of harmful interference against a design standard of ~5 minutes annually.
Sources cited for Unlicensed 6 GHz Wi-Fi Devices (LPI/GVP) Verified to Cause
- Test Shows Wi-Fi Devices in 6 GHz Spectrum Can Disrupt Grid
- NRECA Joins Broad Call for Pause in Approval of New 6 GHz Unlicensed Devices
- Court Denies 6 GHz Band Protection for Utilities; NRECA Seeks New Rules From FCC
- 6 GHz Interference Solutions: Protecting Licensed Microwave from Wi-Fi 6E
- Licensed 6 GHz Links are under threat from all sides
- How to protect mission critical communication links from Wi-Fi 6E interference
- FCC urged to test for 'dangerous' interference from Wi-Fi 6E
- January 8, 2026 FCC FACT SHEET: Unlicensed use of the 6 GHz Band
- Federal Register: Unlicensed Use of the 6 GHz Band; Expanding Flexible Use in Mid-Band Spectrum Between 3.7 and 24 GHz
- GPS Spoofing Attacks on Automated Frequency Coordination System in Wi-Fi 6E and Beyond
Detection coverage for TL-2026-1337
As of 2026-07-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1337 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.