Threat reportICS/SCADATL-2026-4339
Energy & Utilities Cyber Exposure: Ransomware Loss Concentration (Resilience Report) and July 2026 Internet-Exposed PLC Attacks on US Water Utilities (Rockwell MicroLogix)
Energy & Utilities Cyber Exposure (TL-2026-4339), also tracked as AA26-097A, is a high-severity ICS/SCADA threat, first published 2026-10-24. It is attributed to Cyber Av3ngers (Iran) with low confidence, affects Rockwell Automation MicroLogix 1400 (Series B/C), references 4 CVEs (CVE-2017-16740, CVE-2021-22681, CVE-2023-3595), maps to 5 MITRE ATT&CK techniques (T1021.004, T1133, T1190), and is covered by 9 detection rules and 12 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 4Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 1Cyber Av3ngers
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 12Indicators of compromise
Key facts for TL-2026-4339
- Threat ID
- TL-2026-4339
- Also known as
- AA26-097A, July 2026 US water utility PLC attacks
- Severity
- HIGH
- Status
- ACTIVE
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution
- Cyber Av3ngers
- Attribution confidence
- LOW
- Nation-state nexus
- Iran
- Motivation
- UNKNOWN
- Target sectors
- energy, utilities, water-wastewater, critical-infrastructure, government administration
- Target regions
- North America, united states of america
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in Energy & Utilities Cyber Exposure
Malware and tooling: IOCONTROL, Dropbear SSH, EcoStruxure Control Expert, Studio 5000 Logix Designer, TIA Portal
How Energy & Utilities Cyber Exposure works
Resilience claims data shows ransomware drove about 70% of the energy and utilities sector's incurred losses (including reserves) while representing 9% of claims, and email compromise was 21% of energy account claims vs 10% elsewhere. The report also cites a July 2026 campaign in which attackers reached internet-exposed PLCs at water utilities and changed their IP addresses and passwords; the FBI/EPA reported incidents in at least seven states by 2026-07-30.
This record combines two linked threads. (1) Insurance claims analysis: the Resilience report (as summarized by Industrial Cyber; the article itself returned HTTP 403 to direct fetch, so figures come from the hunt skeleton's search-result summary and are not independently verified) states that ransomware drove roughly 70% of energy and utilities incurred losses including reserves while representing 9% of claims; business email compromise accounted for 21% of energy account claims versus 10% elsewhere; 17% of sector claims originated with vendors (24% across the portfolio). Tested backups allowed recovery without paying ransom and network segmentation preserved production during IT compromises.
(2) Active OT campaign: the FBI and EPA warned on 2026-07-30 that since 2026-07-27 water and wastewater utilities in at least seven states reported incidents in which actors remotely accessed internet-facing programmable logic controllers (PLCs), changed their IP addresses and passwords, and caused operators to lose monitoring and control; the FBI named Rockwell Automation MicroLogix 1100/1400 devices. Reported impacts include loss of pressure and flooding, with no confirmed public-health harm. Minnesota was hit hardest (30+ municipal systems; Braham, Plymouth, South St. Paul and Maple Plain named), with Michigan (9 systems) and Georgia (Clayton County Water Authority, Columbus Water Works) also reported by secondary sources; some media report 12 states, which federal sources had not confirmed at time of writing.
Forescout's 2026-08-03 scan (via The Hacker News) found 4,407 internet-exposed Rockwell controllers worldwide (2,844 in the US), 22 internet-facing PLCs in attacked cities, 19 of them on the same mobile carrier networks and vulnerable to CVE-2017-16740 (Modbus TCP buffer overflow, MicroLogix 1400 Series B/C firmware 21.002 and earlier; fixed in 21.003). Port 44818 (EtherNet/IP) is the primary exposure; 59% of exposed hosts sit on Verizon Business, AT&T Mobility or T-Mobile USA networks per Censys. The FBI, EPA and Forescout attributed no actor in the PSA coverage.
Attribution caveat: Tenable, Trend Micro and a Cloud Security Alliance note link the campaign to CyberAv3ngers (Iran IRGC-CEC persona) and to CISA advisory AA26-097A (published April 2026, updated 2026-07-22; also covering Schneider Electric Modicon M340 and Siemens S7-1200, malicious Add-On Instruction changes, HMI manipulation, PLC project-file exfiltration with vendor engineering software from foreign-hosted infrastructure, and Dropbear SSH persistence). Tenable itself notes the attribution of this specific incident rests on timing and TTP alignment rather than a formal federal statement, and the CSA note says the pattern resembles opportunistic at-scale exploitation. Attribution is therefore rated LOW for this incident. Specific IP/domain/hash indicators are published in the CISA AA26-097A STIX bundle; a Trend Micro summary listing IPs, domains and hashes could not be corroborated by a second source and is intentionally not reproduced here. No BeaconBeagle-checkable network IOCs were verifiable.
MITRE ATT&CK techniques used in TL-2026-4339
Lateral Movement
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
Reconnaissance
Affected products and versions in Energy & Utilities Cyber Exposure
- Rockwell Automation — MicroLogix 1400 (Series B/C)
Vulnerable versions: firmware 21.002 and earlier
Fixed in: firmware 21.003 - Rockwell Automation — MicroLogix 1100
Vulnerable versions: internet-exposed units (discontinued 2022-04-30) - Rockwell Automation — Logix controllers incl. ControlLogix 1756 / CompactLogix
Vulnerable versions: exposed units; CVE-2021-22681, CVE-2023-3595, CVE-2024-6242 - Schneider Electric — Modicon M340 (BMX P34)
Vulnerable versions: internet-exposed units per AA26-097A update - Siemens — SIMATIC S7-1200
Vulnerable versions: internet-exposed units per AA26-097A update
Remediation for Energy & Utilities Cyber Exposure
Patches
- MicroLogix 1400 Series B/C firmware 21.003 (CVE-2017-16740)
- Vendor patches for CVE-2023-3595 and CVE-2024-6242 (ControlLogix); CVE-2021-22681 reported without a patch, use compensating controls
Immediate actions
- Remove PLCs from direct internet exposure; inventory reachable controllers on 44818, 2222, 102, 502 and 22
- Set controller physical mode switches to RUN to block remote logic modification
- Upgrade MicroLogix 1400 to firmware 21.003 or later (CVE-2017-16740)
- Ingest CISA AA26-097A indicators into SIEM/IDS/firewall and query logs for connections from overseas infrastructure
- Maintain current offline copies of PLC project files for recovery (Rockwell SD1790 covers password-reset recovery)
Workarounds
- Strengthen password policies and firewalls; disable unused services and protocols
- Contact Rockwell Automation PSIRT and EPA technical support if compromised
Longer-term hardening
- Use secure gateways with multifactor authentication for required remote access
- Use private APN/VPN isolation and replace consumer cellular modems with industrial gateways; enable strong modem authentication
- Segment IT and OT networks and allowlist authorized engineering workstations via ACLs
- Monitor for unauthorized logic, AOI and configuration changes outside maintenance windows
- Keep tested backups and segmentation in place to recover from ransomware without payment; harden email and vendor access
CVEs associated with Energy & Utilities Cyber Exposure
CVE-2017-16740, CVE-2021-22681, CVE-2023-3595, CVE-2024-6242
Timeline of Energy & Utilities Cyber Exposure
- CISA advisory AA23-335A published on earlier CyberAv3ngers PLC campaign (Unitronics PLCs, 75+ devices compromised Oct 2023-Jan 2024 per CSA note)
- Month-level date: CISA reported actors pivoting to exploitation of CVE-2021-22681 (Logix controllers)
- CISA advisory AA26-097A on Iranian-affiliated exploitation of internet-exposed PLCs first published
- AA26-097A updated to include Schneider Electric and Siemens devices, malicious PLC code-module changes and STIX indicators
- Water and wastewater utilities begin reporting PLC incidents (IP address and password changes); Minnesota hit with 30+ systems affected
- FBI and EPA PSA: incidents in at least seven states, MicroLogix 1100/1400 targeted, pressure loss and flooding reported
- Forescout scan finds 4,407 internet-exposed Rockwell controllers (2,844 in US); 22 in attacked cities
- Washington State Department of Health forwards federal alerts to water providers; media report scope of up to 12 states
- The Hacker News publishes Forescout/Censys exposure findings including CVE-2017-16740 and carrier-network concentration
- Cloud Security Alliance research note published on exposed Rockwell PLCs at water utilities
Sources cited for Energy & Utilities Cyber Exposure
- Resilience reports energy and utilities sector faces rising cyber exposure from ransomware, vulnerable OT systems - Industrial Cyber
- FBI and EPA warn hackers target internet-connected PLCs at US water utilities - Industrial Cyber
- Over 4,400 Rockwell PLCs exposed online - The Hacker News
- Cyberattacks hit water facilities in seven states across the US - Engadget
- Washington state warns water utilities of cyber attacks - GovTech
- Minnesota & other US Water Cyber Attacks, CISA AA26-097A - Tenable
- Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure - Trend Micro
- Exposed Rockwell PLCs at Water Utilities: Security Implications and Guidance - Cloud Security Alliance
- Hackers target municipal water systems in states - NBC News
Detection coverage for TL-2026-4339
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4339 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.