# Threat actors targeting internet-exposed PLCs in US water/wastewater sector causing lockouts, disconnections and boil water notices (CISA alert 2026-07-30; Iranian-affiliated PLC campaign AA26-097A)

> On 2026-07-30 CISA warned of a significant increase in threat actors targeting internet-exposed PLCs in the Water and Wastewater Systems sector, changing passwords to lock out operators and changing IP addresses to disconnect controllers, causing boil water notices and sustained manual operations. The FBI reported utilities in at least seven states affected, and 30+ Minnesota community water systems were hit starting 2026-07-26; the CISA alert withheld attribution, while the related joint advisory AA26-097A documents Iranian-affiliated (CyberAv3ngers-linked) PLC exploitation.

- **Published:** 2026-10-27T13:13:50Z
- **Last reviewed:** 2026-10-27T13:13:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4538
- **ID:** TL-2026-4538
- **Severity:** HIGH
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-30 CISA published an alert stating it was observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) sector. Per the alert, actors targeting exposed PLCs modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses, resulting in boil water notices and sustained manual operations. The alert states that entities of all sizes and security maturity are being targeted, that undocumented cellular modems installed by operators or vendors are among the exposure paths, and that third-party integrators may have deployed similar vulnerable configurations across multiple customers. The FBI stated that utilities in at least seven states reported PLC-related incidents. The Tenable SLED guidance article (2026-10-27) cites this alert as context for state, local and education critical-infrastructure defense; it contains no technical indicators itself.

Press and research reporting ties the activity to a coordinated attack on 30+ Minnesota municipal water and wastewater utilities beginning 2026-07-26 (Minnesota IT Services confirmed on 2026-07-28). Braham, Plymouth, South St. Paul and Maple Plain publicly confirmed impact to automated control functions for water towers and lift stations; Braham's treatment plant was offline for roughly two to three hours before staff restored operations with manual overrides, and other utilities disconnected cellular modems to contain the intrusion. No drinking-water quality impact was reported.

Attribution is NOT formally established for the July 30 wave. The CISA alert did not name an actor. The Record reports that multiple sources link the activity to Iran-linked actors and that a WaterISAC memo reportedly confirmed a connection; Tenable researchers tentatively attributed the pattern to the IRGC-linked CyberAv3ngers based on timing and multi-site targeting; U.S. officials have not issued a formal attribution. The closely related joint advisory AA26-097A (FBI, CISA, NSA, EPA, DOE, CNMF, Treasury; published 2026-04-07, updated 2026-07-22) documents Iranian-affiliated APT actors, previously associated with CyberAv3ngers / Shahid Kaveh Group and the IRGC Cyber Electronic Command, disrupting PLCs in Government Services and Facilities, WWS and Energy since at least March 2026. That advisory describes use of leased, third-party hosted infrastructure and the manufacturers' PLC programming software (Rockwell Studio 5000 Logix Designer, Schneider EcoStruxure Control Expert, Siemens TIA Portal) to reach misconfigured internet-exposed PLCs (Rockwell CompactLogix and Micro850, Schneider Modicon M340, Siemens S7-1200) over ports 44818, 2222, 102, 502 and 22; Dropbear SSH was deployed on victim modems via port 22; project files were transferred and malicious versions retaining original ladder logic but adding logic that overrides specific instructions were loaded; and HMI/SCADA displays were manipulated. The July 22 update also added detection guidance for malicious changes to reusable code modules (Add-On Instructions) in Rockwell PLC programs. The advisory's IP indicators are included below; whether they overlap with the July 30 wave is not stated in the sources.

No CVE is cited by CISA for the July 30 activity. A secondary (Cloud Security Alliance) note mentions CVE-2021-22681 (Rockwell Logix Designer authentication key weakness) as a relevant risk, but this is not stated by CISA or the joint advisory and is not asserted here. Primary CISA mitigations: disconnect PLCs from the internet and route remote access through VPN/gateway devices, enable password protection and replace default credentials, apply IP allowlisting for known engineering devices, and maintain secure known-clean PLC image backups; the alert also references Rockwell Automation guidance for MicroLogix 1400 recovery.

## MITRE ATT&CK

- T1219 Remote Access Tools
- T1565 Data Manipulation
- T1531 Account Access Removal
- T1583 Acquire Infrastructure

## Sources

- [CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs](https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs)
- [FBI PSA: Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing PLCs](https://www.ic3.gov/PSA/2026/PSA260730.pdf)
- [Joint Advisory AA26-097A: Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure (updated 2026-07-22)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [CISA warns of spike in water system attacks (The Record)](https://therecord.media/cisa-warns-of-spike-in-water-system-attacks)
- [CISA Issues Alert Urging Water and Wastewater Utilities to Protect OT Against Activity Targeting PLCs (WaterISAC)](https://www.waterisac.org/tlpclear-cisa-issues-alert-urging-water-and-wastewater-utilities-to-protect-ot-against-activity-targeting-plcs)
- [Coordinated OT Attack Disrupts 30+ Minnesota Water Utilities (Cloud Security Alliance research note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-minnesota-water-utilities-ot-attack-202607/)
- [Federal Agencies Warn of Iranian-Affiliated Cyber Actors Exploiting Internet-Facing OT Devices (Crowell)](https://www.crowell.com/en/insights/client-alerts/federal-agencies-warn-of-iranian-affiliated-cyber-actors-exploiting-internet-facing-operational-technology-devices)
- [CISA Primary Mitigations to Reduce Cyber Threats to Operational Technology](https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology)
- [UK NCSC: Secure Connectivity Principles for Operational Technology](https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity)
- [Whole-of-state defense: How SLED agencies can secure critical infrastructure in the AI era (Tenable)](https://www.tenable.com/blog/whole-of-state-security-sled-critical-infrastructure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4538