CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks

1. Executive summary

CISA reportedly observed malicious activity targeting more than 100 internet-exposed US water and wastewater systems during July 2026, commonly involving programmable logic controllers (PLCs) connected directly to cellular modems. The activity sought to disrupt operational technology, but no significant disruption was reported. The reported link to Iranian threat actors is unconfirmed: the verified reference data contains no corresponding MITRE ATT&CK actor profile. No CVE, CVSS score, formal severity classification or CISA KEV entry is identified; for EMEA financial institutions, the immediate concern is analogous exposure in facilities OT and operational dependencies rather than evidence of direct targeting.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The reported activity affected US water and wastewater systems, and the available source does not establish an incident affecting an EMEA financial institution, its ICT services or a regulated third-party provider. UK NIS 2018 obligations should be assessed separately by any UK OES/RDSP that identifies comparable activity within its own environment.

3. Technical analysis & attack chain

Confirmed attack chain

1. Target selection: During July 2026, malicious activity targeted more than 100 internet-exposed systems in the US Water and Wastewater Systems sector.
2. Reachable OT path: The activity commonly involved PLCs connected directly to cellular modems. This configuration exposed operational equipment without an intermediary secure gateway or jump host.
3. Operational objective: The reported objective was disruption of OT systems.
4. Observed result: The attacks caused no significant disruption according to the available reporting.

The source does not establish whether attackers authenticated to, compromised or merely probed every targeted system. It also does not identify an exploited vulnerability, CVE, affected firmware version, authentication bypass, default credential, command sequence, port or industrial protocol. Consequently, direct internet reachability is the confirmed enabling condition; a specific exploitation mechanism is not established.

No malware, payload, persistence mechanism, privilege-escalation technique, command-and-control infrastructure, lateral movement, data access or exfiltration activity is described. Siemens, Schneider Electric and Rockwell Automation ICS are mentioned only in relation to an earlier CISA warning; the source does not confirm that equipment from those vendors was compromised in this campaign.

SecurityWeek reports that targeting occurred across at least 12 US states and names Minnesota, Michigan, South Dakota, Georgia, New Jersey and Alabama. The US government had not publicly confirmed the full geographic scope at publication.

The entire campaign account is single-sourced through SecurityWeek’s reporting of CISA guidance. The Iran-linked attribution is unconfirmed because the verified reference data provides no corresponding MITRE ATT&CK actor profile. No technical evidence is supplied that would independently support attribution.

4. Mitigation & containment

P1 — within 24 hours

• Inventory all internet-accessible OT and ICS assets using internal asset records and authorised external scanning. Prioritise PLCs reachable through cellular modems or public internet connections.
• Remove direct internet exposure wherever it is not operationally required. Disconnect unnecessary cellular connectivity and eliminate publicly reachable management interfaces.
• Where remote access is essential, route it through a controlled secure gateway or jump host and restrict access to explicitly authorised sources.
• Change all remaining default passwords and enforce multifactor authentication on remote-access infrastructure.
• If unexplained access to an exposed controller is identified, isolate it from remote connectivity while preserving operational safety and relevant network, gateway and authentication logs.
• Do not impose broad network blocks based on this advisory: the source provides no malicious IP addresses, domains or other enforceable IOCs.

P2 — within 72 hours

• Apply available security updates to exposed PLCs, cellular gateways, remote-access systems and supporting infrastructure after operational testing.
• Review July 2026 network, gateway and authentication telemetry for unexpected connections to internet-facing OT assets.
• Confirm that firewall policy denies unsolicited inbound access to controllers and permits management only through the approved gateway or jump host.
• Review third-party remote connections and remove accounts, routes or access paths no longer required.
• Begin continuous monitoring of traffic involving any OT system that must remain externally reachable.

P3 — within seven days

• Reassess the external attack surface after remediation to verify that direct PLC and cellular-modem exposure has been removed.
• Establish recurring external exposure reviews because network topology and third-party connectivity can reintroduce reachable services.
• Document justified exceptions, asset owners, permitted access paths and compensating controls for every externally reachable OT system.
• Exercise isolation and manual-operation procedures for facilities OT where loss or manipulation could affect site availability.

The source supplies no product-specific fixed versions, commands, file paths or registry changes; none should be inferred.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

These behaviours describe exposure and review conditions rather than proof of compromise. The reporting is single-sourced; verify before enforcement.

6. Detection

Insufficient indicators to author detection rules.

7. Sources

• SecurityWeek, “CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks,” https://www.securityweek.com/cisa-over-100-internet-exposed-water-systems-targeted-in-july-cyberattacks/, 26 August 2026.

8. Adverse Trace position

Adverse Trace does not assign a formal vulnerability severity because no CVE, CVSS score or CISA KEV entry is identified. Reported impact was limited, with no significant disruption, but directly internet-accessible PLCs constitute a material OT exposure requiring prompt removal or restriction. There is no evidence in the supplied material of direct targeting of EMEA financial services; clients should prioritise facilities OT and critical-site dependency reviews where comparable exposure exists. Attribution to Iran-linked hackers remains unconfirmed, and the campaign details are single-sourced; verify before enforcement. Adverse Trace will monitor for authoritative technical artefacts, confirmed affected products, geographic expansion and evidence of operational impact.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.