Iran-Linked CyberAv3ngers Hit U.S. Water Systems Across 12+ States, Disabling Safety Controls
A coordinated cyberattack campaign tied to Iran's IRGC has struck water and wastewater utilities across at least 12 U.S. states, exploiting internet-exposed programmable logic controllers from Rockwell, Schneider Electric, and Siemens. Attackers disabled safety shutdowns, manipulated operator displays, and forced communities into manual operations — with one Minnesota town declaring a state of emergency.
Overview
A multi-year cyber campaign by CyberAv3ngers — an IRGC Cyber-Electronic Command (IRGC-CEC) affiliated group — has escalated dramatically against U.S. water and wastewater systems. On July 26–27, 2026, a coordinated attack struck over 30 Minnesota communities, followed by confirmed incidents in Michigan, Georgia, and additional states, bringing the total to at least 12 states affected.
The attackers exploited internet-exposed programmable logic controllers (PLCs) — the devices that automate pumps, valves, chemical dosing, and pressure regulation in water treatment. By manipulating PLC logic and operator displays, the attackers disabled safety shutdowns and created conditions where equipment could operate unsafely without alerting operators.
The FBI, CISA, and EPA issued a joint alert on July 30 warning the water sector of active targeting. CISA advisory AA26-097A (updated July 22, days before the Minnesota attack) documents the campaign's evolution from targeting Israeli-made Unitronics PLCs with default credentials to exploiting authentication-bypass vulnerabilities across Rockwell Automation, Schneider Electric, and Siemens platforms.
Despite operational disruption — including boil-water notices, pressure loss, flooding, and emergency declarations — no drinking water contamination has been confirmed. However, EPA data shows over 70% of U.S. water systems failed to comply with 2018 risk assessment requirements, and a Censys scan found 5,219 internet-exposed Rockwell PLCs globally, with 74.6% in the United States.
MITRE ATT&CK Kill Chain
This threat covers 11 of 14 attack phases. Highlighted phases indicate techniques actively used in this campaign.
Attack Breakdown
CyberAv3ngers' campaign has evolved through four distinct phases since 2020, with the current phase representing the most technically sophisticated and operationally impactful wave.
Phase 1 — Propaganda (2020–2022): The group began as a propaganda persona, claiming disruptive attacks on Israeli infrastructure that were later debunked as fabrications. This period established the brand and hacktivist cover for what intelligence agencies now assess as a state-directed operation.
Phase 2 — Unitronics Default Credential Exploitation (Oct 2023–Jan 2024): CyberAv3ngers compromised 75+ internet-exposed Unitronics Vision Series PLCs at U.S. and international water utilities using factory-default passwords. The most prominent victim was the Aliquippa Municipal Water Authority in Pennsylvania, where attackers took control of a booster station. In Ireland, residents of County Mayo lost running water for several days. Attackers left defacement messages: "You have been hacked, down with Israel. Every equipment 'made in Israel' is CyberAv3ngers legal target."
Phase 3 — IOCONTROL Malware (2024–2025): The group developed IOCONTROL, a custom-built malware platform targeting IoT and OT devices. OpenAI disclosed in October 2024 that CyberAv3ngers had used ChatGPT for target reconnaissance and code debugging related to this capability. The U.S. Treasury sanctioned six IRGC-CEC officials in February 2024, and the State Department offered a $10 million bounty.
Phase 4 — Authentication Bypass & Multi-Vendor Exploitation (March 2026–present): The current campaign exploits CVE-2021-22681 (CVSS 9.8) — an authentication bypass in Rockwell Logix controllers that allows anyone who obtains the cryptographic key to pose as legitimate engineering software. Critically, no vendor patch exists; Rockwell states it "cannot be fully addressed with a software patch." In-the-wild exploitation was first confirmed in March 2026.
The attack chain proceeds as follows:
-
Initial Access: Actors connect to internet-exposed PLCs from foreign hosting providers and leased infrastructure, using vendor engineering software (Studio 5000, EcoStruxure, TIA Portal) the same way legitimate operators would.
-
PLC Project File Exfiltration: Actors download project files from victim PLCs to understand the plant's control logic, process layout, and safety configurations.
-
Add-On Instruction (AOI) Manipulation: Malicious project files retain normal-looking ladder logic but insert modified AOIs that disable safety shutdown and alarm systems — the most dangerous technique in the campaign.
-
HMI/SCADA Display Manipulation: Actors alter operator display data so that equipment operates in unsafe conditions without alerting operators — a blind spot that could lead to physical harm.
-
Lockout: PLC passwords are changed and IP addresses modified to disconnect legitimate operators from their own systems.
-
Persistence: In at least one incident, actors deployed Dropbear SSH on victim modems to maintain persistent remote access over port 22.
Real-world impacts in Minnesota:
- Braham (~1,700 pop.): Attack disabled computerized controls and temporarily shut down the city's well and water treatment plant. Restored within ~2 hours.
- Plymouth (~80,000 pop.): IT division disconnected cellular-connected equipment at two water towers and multiple wastewater lift stations. Crews operated manually.
- Maple Plain: Declared a local state of emergency.
- Multiple communities issued boil-water notices and experienced pressure loss and flooding.
The group's techniques have reportedly proliferated to 60+ affiliated hacktivist groups operating through an "Electronic Operations Room," creating a distributed threat landscape.
Recommended Mitigations
Disconnect PLCs from direct internet access immediately
CISA identifies this as the single highest-impact remediation action. If remote access is operationally necessary, use secure industrial gateways with multi-factor authentication and VPN — never expose PLC management interfaces directly. Audit cellular OT connections and replace consumer cellular modems with industrial cellular gateways.
Set physical mode switches to Run
Setting Rockwell ControlLogix physical key switches to 'Run' mode prevents remote modification of PLC logic. This hardware-level control stops attackers from uploading malicious project files or manipulating Add-On Instructions, even if they gain network access to the controller.
Maintain offline PLC logic backups and verify integrity
Keep offline backups of known-good PLC project files on secured physical media with tested restore procedures. Regularly compare running PLC logic against golden copies to detect unauthorized Add-On Instruction modifications or ladder logic changes that disable safety systems.
Ingest CISA IOCs and monitor OT network traffic
Import the STIX-formatted IOC bundles from CISA advisory AA26-097A into your SIEM, IDS, and firewalls. Monitor inbound traffic on ports 44818 (EtherNet/IP), 502 (Modbus), 102 (S7comm), 2222 (SSH), and 22 (Dropbear SSH on OT modems). Alert on connections to PLC management interfaces from unregistered workstations or overseas infrastructure.
Segment IT/OT networks and harden engineering workstations
Isolate OT networks from corporate IT and the internet. Deploy application allowlisting for controller communications. Enable CIP Security on Rockwell platforms. Engineering workstations that run Studio 5000, EcoStruxure, or TIA Portal should be dedicated, hardened, and never used for general-purpose browsing or email.
Address CVE-2021-22681 through compensating controls
No vendor patch exists for this vulnerability. Apply Rockwell's recommended compensating controls: restrict network access to CIP protocol, use CIP Security where supported, and monitor for unauthorized authentication attempts. Also patch CVE-2023-3595 and CVE-2024-6242 on ControlLogix 1756 platforms.