Full Report
Forescout found 22 internet-facing Rockwell Automation programmable logic controllers (PLCs) in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network. Its August 3 scan counted 4,407 exposed Rockwell controllers worldwide, including 2,844 in the United States, but Forescout could not confirm any were compromised. That figure counts exposed
Analysis Summary
# Incident Report: Exposure and Targeting of Rockwell Automation PLCs in Water Sector
## Executive Summary
A series of coordinated cyberattacks has targeted internet-facing Rockwell Automation Programmable Logic Controllers (PLCs) at U.S. water and wastewater utilities across at least seven states. Attackers exploited publicly exposed devices—primarily MicroLogix 1100 and 1400 models—to modify IP addresses, set unauthorized passwords, and disrupt operational visibility. While thousands of devices remain exposed globally, the current campaign has specifically impacted utilities through unauthenticated access to EtherNet/IP ports.
## Incident Details
- **Discovery Date:** July 30, 2026 (FBI/EPA Public Service Announcement)
- **Incident Date:** July 27, 2026 – Ongoing
- **Affected Organization:** Multiple U.S. Water and Wastewater Systems (WWS)
- **Sector:** Critical Infrastructure / Water and Wastewater
- **Geography:** United States (at least 7 to 12 states reported)
## Timeline of Events
### Initial Access
- **Date/Time:** July 27, 2026
- **Vector:** Public Internet Exposure (Direct access via Port 44818)
- **Details:** Attackers identified Rockwell Automation PLCs (MicroLogix series) connected directly to the internet via cellular modems/mobile carrier networks without authentication.
### Lateral Movement
- **Details:** Evidence suggests attackers may leverage shared third-party network configurations or cellular carrier environments to pivot between customers with similar vulnerable setups.
### Data Exfiltration/Impact
- **Details:** Attackers changed PLC IP addresses and set administrative passwords. This resulted in "lockouts," where legitimate operators lost visibility and control of equipment. In some cases, ladder logic (project files) was modified.
### Detection & Response
- **Discovery:** Operators noticed ladder logic discrepancies across several sites and loss of device access.
- **Response Actions:** FBI and EPA issued a joint PSA on July 30; Forescout and Censys performed global scans to identify the scope of exposure (over 4,400 devices found).
## Attack Methodology
- **Initial Access:** Direct connection to internet-facing EtherNet/IP (Port 44818) and Modbus TCP (Port 502).
- **Persistence:** Setting unauthorized passwords on PLCs to prevent operator re-entry.
- **Privilege Escalation:** Not required; devices lacked basic authentication for administrative functions.
- **Defense Evasion:** Not specifically detailed, though changing IP addresses disrupts standard monitoring.
- **Discovery:** Reconnaissance via internet scanning tools (e.g., Shodan, Censys) to find Rockwell/Allen-Bradley hosts.
- **Impact:** Operational disruption via manipulation of project files and unauthorized configuration changes.
## Impact Assessment
- **Financial:** Unknown; recovery requires manual factory resets and logic re-loading.
- **Data Breach:** Exposure of PLC project files and internal network configuration details.
- **Operational:** Significant; loss of control over water treatment/distribution equipment and loss of monitoring capabilities.
- **Reputational:** High; highlights persistent vulnerabilities in critical infrastructure security.
## Indicators of Compromise
- **Network:** Unexpected traffic on Port 44818 (EtherNet/IP) or Port 502 (Modbus).
- **Behavioral:**
- Inability to log into PLC using known credentials.
- Unexpected change in PLC IP address.
- Discrepancies in ladder logic compared to known-good backups.
## Response Actions
- **Containment:** Disconnecting vulnerable PLCs from the public internet immediately.
- **Eradication:** Performing factory resets on compromised MicroLogix units (per Advisory SD1790).
- **Recovery:** Re-downloading known-good project files from offline backups to restored hardware.
## Lessons Learned
- **Exposure is the Primary Risk:** Even without specific vulnerability exploits, the lack of authentication on internet-facing OT hardware is a sufficient vector for total compromise.
- **Cellular Risks:** Large numbers of OT devices are being deployed on mobile carrier networks with public-facing IPs, bypassing traditional enterprise firewalls.
- **Legacy Limitations:** Discontinued hardware (MicroLogix 1100) and unpatched firmware (CVE-2017-16740) exacerbate the difficulty of securing these systems.
## Recommendations
- **Zero Exposure:** Remove all PLCs and controllers from the public-facing internet.
- **Secure Remote Access:** Use Private APNs, VPNs, or Software-Defined Perimeters (SDP) for all cellular-connected OT assets.
- **Authentication:** Implement strong, unique passwords for all PLC configurations.
- **Backup Integrity:** Maintain current, offline copies of PLC ladder logic and project files to facilitate recovery from "lockout" scenarios.
- **Patch Management:** Update MicroLogix 1400 devices to at least firmware revision 21.003 to mitigate Modbus TCP vulnerabilities.