Listen to this Post
Introduction
The digital transformation of water utilities—encompassing smart networks, connected assets, AI-driven predictive analytics, and real-time operational data—promises unprecedented efficiency, resilience, and responsiveness. Yet this connectivity has simultaneously transformed water infrastructure into a prime target for nation-state cyber actors. In July 2026, a coordinated cyberattack campaign attributed to Iranian-affiliated hackers compromised water and wastewater systems across at least seven U.S. states, affecting more than 30 water systems in Minnesota alone and forcing utilities to issue boil-water notices and switch to manual operations. The attackers exploited internet-exposed programmable logic controllers (PLCs) with unchanged default credentials—a vulnerability that has been publicly documented since at least 2023. This incident underscores a critical reality: digitalisation is not merely a technology challenge but a fundamental cybersecurity imperative that demands immediate, coordinated action across IT, OT, and civil infrastructure domains.
Learning Objectives
- Understand the threat landscape facing water utilities, including nation-state tactics, techniques, and procedures (TTPs) targeting industrial control systems
- Master practical hardening techniques for PLCs, SCADA systems, and OT networks, including command-line tools and configuration procedures
- Develop incident response capabilities specific to OT environments, with actionable playbooks for detection, containment, and recovery
You Should Know
- The PLC Exposure Crisis: How Default Credentials Enable Nation-State Attacks
The July 2026 attacks followed a well-documented pattern. In November 2023, the Iranian-affiliated CyberAv3ngers group compromised Unitronics PLCs at the Municipal Water Authority of Aliquippa, Pennsylvania, by exploiting default administrative passwords. The group disabled control panels and displayed anti-Israeli messages on HMI screens. In 2024, additional attacks targeted multiple U.S. water utilities. The 2026 campaign escalated dramatically in scale and coordination, with the FBI warning that “some of that activity degraded water operations”.
The technical root cause is alarmingly simple. A Shodan scan conducted in August 2026 identified approximately 4,400 internet-exposed Rockwell Automation PLCs globally, with 2,844 (65%) located in the United States. Many of these devices use default credentials or weak authentication. CISA has repeatedly warned since 2018 against exposing PLCs to the internet. Yet the problem persists.
Step-by-step guide: Identifying and remediating exposed PLCs
Step 1: Discover exposed OT assets using Shodan
Search for exposed Rockwell Automation PLCs using EtherNet/IP protocol (port 44818 is the default EtherNet/IP port) shodan search "port:44818 Rockwell Automation" --limit 100 Search for Unitronics devices with default credentials shodan search "Unitronics Vision" --limit 50 Export results for analysis shodan download water_plcs "port:44818" --limit 1000
Step 2: Scan internal OT networks for vulnerable devices
Use Nmap to discover PLCs on your OT network segment nmap -sS -p 44818,502,102,2222 192.168.10.0/24 Identify devices with default credentials using ICS-specific scripts nmap --script modbus-discover -p 502 192.168.10.0/24 nmap --script s7-info -p 102 192.168.10.0/24 Check for Unitronics default password vulnerability (CVE-2023-6448) nmap -p 20256,20257 --script unitronics-default-pass 192.168.10.0/24
Step 3: Immediately remediate identified exposures
- Disconnect the PLC from the internet immediately. Remote access for operational purposes must go through a VPN or gateway device, not directly to the PLC.
- Change all default passwords on every PLC and HMI. For Unitronics devices, ensure the default password “1111” is not in use.
- Enable password protection on all OT devices and enforce strong, unique credentials.
- Implement IP allowlisting to restrict remote access to known engineering workstations and critical OT assets.
- Network Segmentation: Building an Industrial Demilitarized Zone (IDMZ)
The convergence of IT and OT networks has created a single point of failure. In the 2026 attacks, adversaries moved laterally from exposed internet-facing devices into internal OT networks. Network segmentation is no longer optional—it is essential.
Step-by-step guide: Implementing IT/OT segmentation
Step 1: Audit existing network architecture
Map network topology and identify IT-OT interconnections traceroute -1 192.168.10.1 Trace route to OT gateway nmap -sn 192.168.0.0/16 Discover all active devices on the network Identify unsecured IT-OT connections nmap -p 44818,502,102,2222 --open 192.168.0.0/16
Step 2: Deploy a firewall with OT-specific rule sets
Linux (iptables):
Create an industrial DMZ zone Allow only specific OT protocols from authorized IT subnets iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 44818 -s 10.0.0.0/24 -j ACCEPT iptables -A FORWARD -i eth0 -o eth1 -p tcp --dport 502 -s 10.0.0.0/24 -j ACCEPT iptables -A FORWARD -i eth0 -o eth1 -j DROP Block all other traffic
Windows (using Windows Firewall with Advanced Security):
Create inbound rules for OT traffic New-1etFirewallRule -DisplayName "Allow Modbus from IT subnet" -Direction Inbound ` -LocalPort 502 -Protocol TCP -RemoteAddress 10.0.0.0/24 -Action Allow Block all other traffic to OT network New-1etFirewallRule -DisplayName "Block all other OT traffic" -Direction Inbound ` -Action Block
Step 3: Implement unidirectional gateways where feasible
For critical OT systems that only need to send data to IT networks (e.g., telemetry data), deploy unidirectional gateways that physically prevent inbound traffic from reaching OT devices.
- Securing Remote Access: VPNs, Jump Hosts, and MFA
In the 2026 attacks, adversaries gained access through poorly secured remote access points. CISA explicitly recommends removing OT connections to the public internet and securing remote access through VPNs or jump hosts with multi-factor authentication (MFA).
Step-by-step guide: Deploying secure remote access
Step 1: Deploy an OT-specific VPN concentrator
Example: OpenVPN configuration for OT access Install OpenVPN on a dedicated jump host apt-get install openvpn Generate server certificates ./easy-rsa/easyrsa init-pki ./easy-rsa/easyrsa build-ca ./easy-rsa/easyrsa gen-req server ./easy-rsa/easyrsa sign-req server server Configure server.conf to restrict access to OT subnets echo "push 'route 192.168.10.0 255.255.255.0'" >> /etc/openvpn/server.conf echo "client-to-client" >> /etc/openvpn/server.conf
Step 2: Implement a jump host / bastion server
Configure SSH jump host with MFA apt-get install libpam-google-authenticator Enable MFA in /etc/pam.d/sshd echo "auth required pam_google_authenticator.so" >> /etc/pam.d/sshd Restrict SSH access to specific source IPs echo "sshd: 10.0.0.0/24" >> /etc/hosts.allow
Step 3: Enforce MFA for all remote access
- Require MFA for all remote access, including third-party vendors.
- Use role-based permissions to limit exposure.
- Regularly audit remote access logs for anomalies.
4. PLC Hardening: Configuration and Patch Management
The Unitronics default password vulnerability (CVE-2023-6448) carries a CVSS score of 9.8 (Critical). Attackers with network access can take administrative control of vulnerable systems. Beyond default credentials, many PLCs run outdated firmware with known vulnerabilities.
Step-by-step guide: Hardening PLC configurations
Step 1: Inventory all PLCs and HMIs
Use Nmap to discover PLCs and identify firmware versions nmap -sV -p 44818,502,102 192.168.10.0/24 --script banner
Step 2: Change default credentials
| Device Type | Default Credential | Action |
|-|-|–|
| Unitronics Vision/Samba | Password: 1111 | Change immediately |
| Rockwell Automation | Various defaults | Change immediately |
| Schneider Electric | Various defaults | Change immediately |
Step 3: Update firmware to latest patched versions
- Unitronics users must update to VisiLogic version 9.9.00 or later.
- Implement a regular patch management cycle for all OT devices.
- Test patches in a staging environment before production deployment.
Step 4: Disable unnecessary services and ports
Example: Disable unused services on a Linux-based SCADA host systemctl disable telnet systemctl disable ftp systemctl stop telnet systemctl stop ftp Block unused ports iptables -A INPUT -p tcp --dport 23 -j DROP Telnet iptables -A INPUT -p tcp --dport 21 -j DROP FTP iptables -A INPUT -p udp --dport 161 -j DROP SNMP (if not needed)
5. Monitoring and Detection: Building OT-Specific Threat Visibility
Traditional IT security monitoring tools often fail in OT environments due to protocol differences and performance requirements. The 2026 attacks demonstrated that many utilities lacked visibility into malicious activity on their OT networks.
Step-by-step guide: Implementing OT monitoring
Step 1: Deploy passive network monitoring for OT protocols
Use Wireshark to capture and analyze Modbus traffic tshark -i eth1 -f "port 502" -w modbus_traffic.pcap Analyze captured traffic for anomalies tshark -r modbus_traffic.pcap -Y "modbus.func_code == 16" Write Multiple Registers tshark -r modbus_traffic.pcap -Y "modbus.func_code == 15" Write Multiple Coils
Step 2: Implement anomaly detection systems
- Deploy OT-specific SIEM solutions that understand industrial protocols.
- Establish baselines for normal OT behavior and alert on deviations.
- Integrate threat databases for real-time monitoring across Energy and Water sectors.
Step 3: Enable logging on all OT devices
Configure syslog forwarding from OT devices echo ". @192.168.1.100:514" >> /etc/rsyslog.conf Forward to SIEM systemctl restart rsyslog
6. Incident Response: Preparing for the Inevitable
The scale and coordination of the 2026 attacks were unprecedented. Utilities must have an incident response plan specifically for OT environments.
Step-by-step guide: Building an OT incident response capability
Step 1: Develop a Cybersecurity Incident Response Plan (CIRP)
The EPA provides a fully customizable Cybersecurity Incident Response Plan Template for drinking water and wastewater systems. Key elements include:
- Clear roles and responsibilities for OT incident response
- Procedures for isolating compromised OT systems
- Communication protocols with regulators and the public
- Recovery procedures for returning to normal operations
Step 2: Practice manual operations
CISA recommends that utilities “practice and maintain the ability to operate OT systems manually”. In the 2026 attacks, utilities that could switch to manual mode maintained service continuity.
Step 3: Establish backup and recovery procedures
- Regularly back up PLC configurations and logic programs.
- Store backups offline in secure locations.
- Test restoration procedures regularly.
7. The Talent Gap: Building Cyber-Aware Workforces
Matt Phillips of Metric Geo highlighted a critical challenge: “How do you combat the specialisms of Civil Infrastructure, Cyber and Automation at the same time?” This talent gap is a fundamental vulnerability. WaterISAC emphasizes the need to “create a cyber secure culture and protect from insider risks”.
Key actions:
- Integrate cybersecurity training into all operational roles.
- Develop cross-functional teams bridging IT, OT, and engineering.
- Partner with organizations like SWAN – The Smart Water Networks Forum for industry-specific guidance.
- Leverage resources like WaterISAC’s 12 Cybersecurity Fundamentals for Water and Wastewater Utilities.
What Undercode Say
- Digital transformation without security is a liability. The 2026 attacks prove that connectivity enables efficiency but also exposes critical infrastructure to nation-state adversaries. The question is not “What technology can we implement?” but “What do we need to change to make digital genuinely deliver?”—and security must be the foundation of that change.
-
Default credentials are the Achilles’ heel of industrial control systems. The persistence of default passwords on internet-exposed PLCs—despite years of CISA warnings—represents an unacceptable risk. The water sector must treat credential management as a non-1egotiable operational requirement, not an optional IT best practice.
Analysis: The July 2026 attacks represent a watershed moment for water sector cybersecurity. They demonstrate that adversaries are actively scanning for and exploiting the same vulnerabilities that have been documented for years. The attacks were not sophisticated—they exploited weak cybersecurity practices such as unchanged default passwords and poorly secured internet-connected equipment. Yet they succeeded in disrupting water services across multiple states, forcing boil-water notices, and creating widespread public anxiety. The psychological impact, as cybersecurity experts noted, was the primary objective. This is “perception hacking”—small-scale operations amplified through media coverage to project reach and intimidate. The water sector must recognize that even unsophisticated attacks can have significant operational and psychological impacts. The solution lies not in expensive, complex security measures but in fundamental cyber hygiene: removing OT from the public internet, changing default passwords, segmenting networks, and enforcing MFA.
Prediction
- +1 Regulatory frameworks will tighten significantly. Expect mandatory cybersecurity standards for water utilities within 12–18 months, building on CISA’s Cybersecurity Performance Goals 2.0 and EPA’s emerging requirements.
-
-1 The water sector will continue to struggle with the talent gap. The convergence of civil infrastructure, automation, and cybersecurity expertise is rare, and utilities will face increasing competition for skilled professionals. This shortage will delay security improvements at smaller utilities.
-
+1 AI-powered threat detection for OT environments will accelerate. The 2026 attacks will drive investment in machine learning-based anomaly detection that can identify malicious activity on industrial networks without requiring deep OT security expertise.
-
-1 Nation-state cyber campaigns against water infrastructure will intensify. Iran’s demonstrated capability and willingness to target U.S. water systems, combined with the geopolitical backdrop of ongoing conflict, suggests that these attacks are not anomalies but a new front in hybrid warfare.
-
+1 Information sharing will improve. The Water Information Sharing and Analysis Center (WaterISAC) and SWAN Forum will play increasingly critical roles in disseminating threat intelligence and best practices. Utilities that actively participate in these communities will be better positioned to defend against emerging threats.
▶️ Related Video (80% Match):
https://www.youtube.com/watch?v=1VwpeTDuXIs
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/eqnbNRxu – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
