Full Report
'These are test runs for a larger-scale attack'
Analysis Summary
# Incident Report: Multi-State Water Sector PLC Targeting Campaign
## Executive Summary
In July 2026, over 100 internet-exposed Programmable Logic Controllers (PLCs) within the U.S. Water and Wastewater Systems (WWS) sector were compromised or targeted by malicious cyber actors. The campaign leveraged AI-generated exploitation scripts to target legacy operational technology (OT) connected directly to the internet via cellular modems. While no widespread service disruption was reported, experts characterize these intrusions as "test runs" for larger-scale future attacks against critical infrastructure.
## Incident Details
- **Discovery Date:** July 2026
- **Incident Date:** July 2026 (Ongoing activity reported through August 2026)
- **Affected Organization:** Over 100 Water and Wastewater Systems (WWS) utilities
- **Sector:** Critical Infrastructure / Water and Wastewater
- **Geography:** United States (at least 12 states identified, including Pennsylvania, South Dakota, and New Jersey)
## Timeline of Events
### Initial Access
- **Date/Time:** July 2026
- **Vector:** Exploitation of internet-exposed hardware.
- **Details:** Attackers targeted Siemens S7 Series PLCs and other controllers connected directly to the open internet via cellular modems, bypassing traditional network perimeters.
### Lateral Movement
- **Details:** Minimal lateral movement reported; the primary objective appeared to be direct interaction with the exposed PLCs to test exploitation capabilities.
### Data Exfiltration/Impact
- **Details:** No significant data exfiltration or physical damage reported. The primary impact was the unauthorized access to critical control systems, serving as a proof-of-concept for future disruption.
### Detection & Response
- **Detection:** Observed by CISA and federal partners through monitoring of malicious activity targeting WWS sector assets.
- **Response:** CISA issued urgent advisories to water sector operators; five federal agencies released a joint warning regarding the use of AI-generated exploitation scripts.
## Attack Methodology
- **Initial Access:** Direct connection to internet-exposed PLCs via cellular modems.
- **Persistence:** Utilization of default credentials or lack of password protection on OT assets.
- **Privilege Escalation:** Not explicitly detailed, though default administrative access to PLCs was a primary factor.
- **Defense Evasion:** Use of obscured infrastructure and AI-generated scripts to automate and vary exploitation attempts.
- **Credential Access:** Targeting systems with default passwords or no password protection.
- **Discovery:** Scanning for internet-facing OT assets (e.g., via Shodan or similar tools).
- **Lateral Movement:** N/A (Direct access to target assets).
- **Impact:** Potential for future unauthorized control of water treatment processes (e.g., chemical levels, flow control).
## Impact Assessment
- **Financial:** Costs associated with emergency remediation, incident response, and security auditing across 100+ facilities.
- **Data Breach:** Exposure of system configurations and operational parameters.
- **Operational:** Low immediate disruption, but high risk of future catastrophic failure.
- **Reputational:** Increased public concern regarding the vulnerability of municipal critical infrastructure.
## Indicators of Compromise
- **Network Indicators:** Connections from unauthorized IP addresses to PLC management ports (e.g., Port 102 for Siemens S7).
- **Behavioral Indicators:** Multiple failed login attempts on OT assets; unauthorized logic changes or configuration reads; use of AI-generated exploitation patterns.
## Response Actions
- **Containment:** Operators were directed to disconnect PLCs from the public internet immediately.
- **Eradication:** Changing default passwords and implementing password protection on all OT interfaces.
- **Recovery:** Restoring system configurations and implementing secure remote access solutions.
## Lessons Learned
- **Systemic Vulnerability:** The WWS sector suffers from a high volume of legacy OT assets that were never designed for internet connectivity.
- **AI-Enhanced Threats:** The use of AI-generated scripts has lowered the barrier to entry for exploiting specific industrial hardware.
- **Visibility Gaps:** Many utilities were unaware their cellular modems provided a direct path from the public internet to their control logic.
## Recommendations
- **Network Architecture:** Disconnect all PLCs/OT assets from the public internet. Use VPNs or secure gateways for all remote access.
- **Identity Management:** Implement Multi-Factor Authentication (MFA) for all remote access and change all factory-default passwords.
- **Access Control:** Implement IP allowlisting to ensure only authorized engineering workstations can communicate with OT assets.
- **Monitoring:** Deploy OT-specific network monitoring to detect unauthorized configuration changes or anomalous traffic.