Threat reportICS/SCADATL-2026-4538
Threat actors targeting internet-exposed PLCs in US water/wastewater sector causing lockouts, disconnections and boil water notices (CISA alert 2026-07-30; Iranian-affiliated PLC campaign AA26-097A)
Threat actors targeting internet-exposed PLCs in US (TL-2026-4538), also tracked as PLC lockout campaign against water utilities, is a high-severity ICS/SCADA threat, first published 2026-10-27. It is linked to a Iran-nexus actor with low confidence, affects Rockwell Automation Allen-Bradley CompactLogix / Micro850 (also, maps to 4 MITRE ATT&CK techniques (T1219, T1531, T1565), and is covered by 9 detection rules and 26 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 26Indicators of compromise
Key facts for TL-2026-4538
- Threat ID
- TL-2026-4538
- Also known as
- PLC lockout campaign against water utilities, Minnesota water utilities OT attack
- Severity
- HIGH
- Status
- ACTIVE
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Nation-state nexus
- Iran
- Motivation
- DESTRUCTION
- Target sectors
- water and wastewater, government services and facilities, energy
- Target regions
- united states of america, North America
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Threat actors targeting internet-exposed PLCs in US
Malware and tooling: Dropbear SSH, Rockwell Automation Studio 5000 Logix Designer, Schneider Electric EcoStruxure Control Expert, Siemens TIA Portal
How Threat actors targeting internet-exposed PLCs in US works
On 2026-07-30 CISA warned of a significant increase in threat actors targeting internet-exposed PLCs in the Water and Wastewater Systems sector, changing passwords to lock out operators and changing IP addresses to disconnect controllers, causing boil water notices and sustained manual operations. The FBI reported utilities in at least seven states affected, and 30+ Minnesota community water systems were hit starting 2026-07-26; the CISA alert withheld attribution, while the related joint advisory AA26-097A documents Iranian-affiliated (CyberAv3ngers-linked) PLC exploitation.
On 2026-07-30 CISA published an alert stating it was observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) sector. Per the alert, actors targeting exposed PLCs modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses, resulting in boil water notices and sustained manual operations. The alert states that entities of all sizes and security maturity are being targeted, that undocumented cellular modems installed by operators or vendors are among the exposure paths, and that third-party integrators may have deployed similar vulnerable configurations across multiple customers. The FBI stated that utilities in at least seven states reported PLC-related incidents. The Tenable SLED guidance article (2026-10-27) cites this alert as context for state, local and education critical-infrastructure defense; it contains no technical indicators itself.
Press and research reporting ties the activity to a coordinated attack on 30+ Minnesota municipal water and wastewater utilities beginning 2026-07-26 (Minnesota IT Services confirmed on 2026-07-28). Braham, Plymouth, South St. Paul and Maple Plain publicly confirmed impact to automated control functions for water towers and lift stations; Braham's treatment plant was offline for roughly two to three hours before staff restored operations with manual overrides, and other utilities disconnected cellular modems to contain the intrusion. No drinking-water quality impact was reported.
Attribution is NOT formally established for the July 30 wave. The CISA alert did not name an actor. The Record reports that multiple sources link the activity to Iran-linked actors and that a WaterISAC memo reportedly confirmed a connection; Tenable researchers tentatively attributed the pattern to the IRGC-linked CyberAv3ngers based on timing and multi-site targeting; U.S. officials have not issued a formal attribution. The closely related joint advisory AA26-097A (FBI, CISA, NSA, EPA, DOE, CNMF, Treasury; published 2026-04-07, updated 2026-07-22) documents Iranian-affiliated APT actors, previously associated with CyberAv3ngers / Shahid Kaveh Group and the IRGC Cyber Electronic Command, disrupting PLCs in Government Services and Facilities, WWS and Energy since at least March 2026. That advisory describes use of leased, third-party hosted infrastructure and the manufacturers' PLC programming software (Rockwell Studio 5000 Logix Designer, Schneider EcoStruxure Control Expert, Siemens TIA Portal) to reach misconfigured internet-exposed PLCs (Rockwell CompactLogix and Micro850, Schneider Modicon M340, Siemens S7-1200) over ports 44818, 2222, 102, 502 and 22; Dropbear SSH was deployed on victim modems via port 22; project files were transferred and malicious versions retaining original ladder logic but adding logic that overrides specific instructions were loaded; and HMI/SCADA displays were manipulated. The July 22 update also added detection guidance for malicious changes to reusable code modules (Add-On Instructions) in Rockwell PLC programs. The advisory's IP indicators are included below; whether they overlap with the July 30 wave is not stated in the sources.
No CVE is cited by CISA for the July 30 activity. A secondary (Cloud Security Alliance) note mentions CVE-2021-22681 (Rockwell Logix Designer authentication key weakness) as a relevant risk, but this is not stated by CISA or the joint advisory and is not asserted here. Primary CISA mitigations: disconnect PLCs from the internet and route remote access through VPN/gateway devices, enable password protection and replace default credentials, apply IP allowlisting for known engineering devices, and maintain secure known-clean PLC image backups; the alert also references Rockwell Automation guidance for MicroLogix 1400 recovery.
MITRE ATT&CK techniques used in TL-2026-4538
Command and Control
Impact
T1531 Account Access Removal; T1565 Data Manipulation
Resource Development
Affected products and versions in Threat actors targeting internet-exposed PLCs in US
- Rockwell Automation — Allen-Bradley CompactLogix / Micro850 (also MicroLogix 1400 recovery guidance referenced)
Vulnerable versions: Internet-exposed, misconfigured devices (specific versions not stated) - Schneider Electric — Modicon M340 (BMX P34)
Vulnerable versions: Internet-exposed, misconfigured devices (specific versions not stated) - Siemens — SIMATIC S7-1200
Vulnerable versions: Internet-exposed, misconfigured devices (specific versions not stated)
Remediation for Threat actors targeting internet-exposed PLCs in US
Patches
- Apply latest manufacturer firmware and software updates for Rockwell, Schneider Electric and Siemens PLCs per AA26-097A
- Follow Rockwell Automation guidance for MicroLogix 1400 recovery referenced in the CISA alert
Immediate actions
- Disconnect PLCs and other OT from the public internet; route any remote access through a VPN or secure gateway
- Inventory and document all cellular modems and OT assets, including undocumented vendor/operator-installed modems
- Block and hunt for the AA26-097A IP indicators on perimeter and OT-adjacent logs
- Revert to manual operations if anomalous PLC behavior is observed
Workarounds
- Place the physical PLC mode switch in RUN position and validate project files before changing mode
- Block unnecessary ports and disable unused services (Telnet, FTP, RDP, VNC)
- Review Add-On Instructions for unauthorized modification
Longer-term hardening
- Enable password protection and replace default credentials on all PLCs
- Implement IP allowlisting limited to known engineering workstations
- Maintain secure, known-clean PLC image and project backups for recovery from lockout
- Coordinate with integrators and vendors, who may have deployed the same exposed configuration across customers
- Require MFA for external access to OT networks and monitor for protocol and configuration-change anomalies
Timeline of Threat actors targeting internet-exposed PLCs in US
- November 2023: CyberAv3ngers campaign against internet-exposed Unitronics PLCs compromised at least 75 devices (prior wave cited in AA26-097A reporting)
- Since at least March 2026, Iranian-affiliated APT actors disrupt PLCs in government, water/wastewater and energy sectors (per AA26-097A)
- FBI, CISA, NSA, EPA, DOE and partners publish joint advisory AA26-097A with initial IP indicators
- AA26-097A updated: adds Schneider Electric and Siemens PLC targeting, new IP indicators, and detection guidance for malicious Rockwell Add-On Instruction changes
- Coordinated attack begins against 30+ Minnesota community water and wastewater systems via exposed PLCs and cellular modems; Braham plant offline 2-3 hours
- Minnesota IT Services confirms the incident and activates incident response with CISA, EPA, FBI and affected utilities
- CISA alert reports a significant increase in actors targeting WWS PLCs (password changes, IP address changes, boil water notices); FBI PSA states utilities in at least seven states reported incidents
- WaterISAC distributes the CISA alert; press reports Iran-linked attribution while CISA's alert withholds it
- Tenable publishes SLED critical-infrastructure guidance citing the CISA alert
Sources cited for Threat actors targeting internet-exposed PLCs in US
- CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
- FBI PSA: Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing PLCs
- Joint Advisory AA26-097A: Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure (updated 2026-07-22)
- CISA warns of spike in water system attacks (The Record)
- CISA Issues Alert Urging Water and Wastewater Utilities to Protect OT Against Activity Targeting PLCs (WaterISAC)
- Coordinated OT Attack Disrupts 30+ Minnesota Water Utilities (Cloud Security Alliance research note)
- Federal Agencies Warn of Iranian-Affiliated Cyber Actors Exploiting Internet-Facing OT Devices (Crowell)
- CISA Primary Mitigations to Reduce Cyber Threats to Operational Technology
- UK NCSC: Secure Connectivity Principles for Operational Technology
- Whole-of-state defense: How SLED agencies can secure critical infrastructure in the AI era (Tenable)
Detection coverage for TL-2026-4538
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4538 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.