# Energy & Utilities Cyber Exposure: Ransomware Loss Concentration (Resilience Report) and July 2026 Internet-Exposed PLC Attacks on US Water Utilities (Rockwell MicroLogix)

> Resilience claims data shows ransomware drove about 70% of the energy and utilities sector's incurred losses (including reserves) while representing 9% of claims, and email compromise was 21% of energy account claims vs 10% elsewhere. The report also cites a July 2026 campaign in which attackers reached internet-exposed PLCs at water utilities and changed their IP addresses and passwords; the FBI/EPA reported incidents in at least seven states by 2026-07-30.

- **Published:** 2026-10-24T03:53:14Z
- **Last reviewed:** 2026-10-24T03:53:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4339
- **ID:** TL-2026-4339
- **Severity:** HIGH
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Actor:** Cyber Av3ngers (Iran)
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-16740, CVE-2021-22681, CVE-2023-3595, CVE-2024-6242

## Description

This record combines two linked threads. (1) Insurance claims analysis: the Resilience report (as summarized by Industrial Cyber; the article itself returned HTTP 403 to direct fetch, so figures come from the hunt skeleton's search-result summary and are not independently verified) states that ransomware drove roughly 70% of energy and utilities incurred losses including reserves while representing 9% of claims; business email compromise accounted for 21% of energy account claims versus 10% elsewhere; 17% of sector claims originated with vendors (24% across the portfolio). Tested backups allowed recovery without paying ransom and network segmentation preserved production during IT compromises.

(2) Active OT campaign: the FBI and EPA warned on 2026-07-30 that since 2026-07-27 water and wastewater utilities in at least seven states reported incidents in which actors remotely accessed internet-facing programmable logic controllers (PLCs), changed their IP addresses and passwords, and caused operators to lose monitoring and control; the FBI named Rockwell Automation MicroLogix 1100/1400 devices. Reported impacts include loss of pressure and flooding, with no confirmed public-health harm. Minnesota was hit hardest (30+ municipal systems; Braham, Plymouth, South St. Paul and Maple Plain named), with Michigan (9 systems) and Georgia (Clayton County Water Authority, Columbus Water Works) also reported by secondary sources; some media report 12 states, which federal sources had not confirmed at time of writing.

Forescout's 2026-08-03 scan (via The Hacker News) found 4,407 internet-exposed Rockwell controllers worldwide (2,844 in the US), 22 internet-facing PLCs in attacked cities, 19 of them on the same mobile carrier networks and vulnerable to CVE-2017-16740 (Modbus TCP buffer overflow, MicroLogix 1400 Series B/C firmware 21.002 and earlier; fixed in 21.003). Port 44818 (EtherNet/IP) is the primary exposure; 59% of exposed hosts sit on Verizon Business, AT&T Mobility or T-Mobile USA networks per Censys. The FBI, EPA and Forescout attributed no actor in the PSA coverage.

Attribution caveat: Tenable, Trend Micro and a Cloud Security Alliance note link the campaign to CyberAv3ngers (Iran IRGC-CEC persona) and to CISA advisory AA26-097A (published April 2026, updated 2026-07-22; also covering Schneider Electric Modicon M340 and Siemens S7-1200, malicious Add-On Instruction changes, HMI manipulation, PLC project-file exfiltration with vendor engineering software from foreign-hosted infrastructure, and Dropbear SSH persistence). Tenable itself notes the attribution of this specific incident rests on timing and TTP alignment rather than a formal federal statement, and the CSA note says the pattern resembles opportunistic at-scale exploitation. Attribution is therefore rated LOW for this incident. Specific IP/domain/hash indicators are published in the CISA AA26-097A STIX bundle; a Trend Micro summary listing IPs, domains and hashes could not be corroborated by a second source and is intentionally not reproduced here. No BeaconBeagle-checkable network IOCs were verifiable.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1021.004 SSH
- T1531 Account Access Removal

## Sources

- [Resilience reports energy and utilities sector faces rising cyber exposure from ransomware, vulnerable OT systems - Industrial Cyber](https://industrialcyber.co/reports/resilience-reports-energy-and-utilities-sector-faces-rising-cyber-exposure-from-ransomware-vulnerable-ot-systems/)
- [FBI and EPA warn hackers target internet-connected PLCs at US water utilities - Industrial Cyber](https://industrialcyber.co/utilities-energy-power-water-waste/fbi-and-epa-warn-hackers-target-internet-connected-plcs-at-us-water-utilities-leading-to-operational-disruptions/)
- [Over 4,400 Rockwell PLCs exposed online - The Hacker News](https://thehackernews.com/2026/08/over-4400-rockwell-plcs-exposed-online.html)
- [Cyberattacks hit water facilities in seven states across the US - Engadget](https://engadget.com/2228441/cyberattacks-water-facilities-seven-states-across-the-us)
- [Washington state warns water utilities of cyber attacks - GovTech](https://www.govtech.com/security/washington-state-warns-water-utilities-of-cyber-attacks)
- [Minnesota & other US Water Cyber Attacks, CISA AA26-097A - Tenable](https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know)
- [Federal Agencies Warn of Ongoing PLC Exploitation Against Critical U.S. Infrastructure - Trend Micro](https://www.trendmicro.com/en_us/research/26/g/plc-exploitation.html)
- [Exposed Rockwell PLCs at Water Utilities: Security Implications and Guidance - Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-rockwell-plc-water-utility-exposure-202608/)
- [Hackers target municipal water systems in states - NBC News](https://www.nbcwashington.com/news/national-international/hackers-municipal-water-systems-states/4136930/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4339