Tia N.List

Reported by 5 outlets

US Water-Sector Campaign Now Confirmed in 12 States — Georgia's Clayton County Confirms Disruption as FBI Details PLC Tampering

hot0.0
Why this score
Breadth
2.00 / 2.0 · 5 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
5.00 / 5.0 · CVSS + KEV signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.00 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
securityweek.comcisa.govnvd.nist.govbleepingcomputer.comcyberscoop.com CVE-2021-22681 KEV desk first seen 77d ago

Desk analysis

Since July 26, attackers have been reconfiguring operational technology at US water utilities, starting with more than 30 Minnesota community water systems and expanding to at least 12 states. The newest confirmations are Clayton County Water Authority in Georgia, which reported a temporary disruption and reduced water pressure restored within hours, plus Michigan, Rapid City South Dakota's wastewater lift station, Cape May and Woodbine in New Jersey, and Alabama utilities. The FBI's alert describes the tradecraft precisely: internet-exposed Rockwell MicroLogix 1100/1400 PLCs get their IP addresses and passwords changed to cause loss of view and, in some cases, function, and at least one victim found modified PLC project files with ladder-logic discrepancies across sites. CISA advisory AA26-097A, expanded on July 22, ties the profile to Iranian-affiliated actors CyberAv3ngers and Handala; the government has not formally attributed, and the underlying controller flaw is CVE-2021-22681, an authentication bypass CISA added to the KEV catalog on March 5, 2026.

The decisive fact is that the enabling defect has no patch. Rockwell's own position in ICSA-21-056-03, published February 25, 2021, is that CVE-2021-22681 cannot be mitigated with a patch; the controls it names are architectural, namely network segmentation, blocking TCP 44818 from outside the control-system zone, and CIP Security. That reframes the campaign: Censys counted 4,100+ exposed Rockwell/Allen-Bradley hosts, 4,100 Siemens, and 2,000+ Schneider hosts, and nearly half of the Rockwell devices are reachable over carrier networks including Verizon, AT&T, T-Mobile, Comcast, Charter, and Starlink. Those cellular-connected units match Plymouth's report that impact was limited to cellular-connected equipment and the Rapid City lift station pattern, which means the perimeter that matters is the carrier's, not the utility's, and enterprise-side attack-surface scans will not see the beachhead. This is why the story outranks routine CVE churn: a CVSS 9.8 flaw with no vendor fix, exploited by an actor profile with 2020 Israeli water-sector precedent, produces a permanent exposure condition that only changes when the network architecture does.

Defenders should do four things in order. Remove internet-exposed PLCs from the internet, or force all remote access through a VPN gateway with IP allowlists and changed default credentials. Audit for undocumented cellular modems installed by operators, vendors, or integrators, since CISA flagged these as the likely Minnesota entry vector and they evade conventional asset discovery. Enforce the vendor mitigations from ICSA-21-056-03: block TCP 44818 at the ICS zone boundary, deploy CIP Security on supported Logix devices (1756-EN4TR modules where controllers cannot do it natively), set controllers to Run mode, and keep known-clean MicroLogix 1400 image backups because password lockout has no in-place recovery. For hunting, enable the Controller Log feature on v17+ and Change Detection in Logix Designer v20+, review controller change logs and FactoryTalk AssetCentre for unexpected edits, diff ladder logic across sites for the cross-site discrepancies the FBI documented, and review AA26-097A indicators against firewall and VPN logs.

Two developments would change the assessment. Formal US attribution to Iran would convert a sector incident into a geopolitical one, with sanctions, possible retaliation, and a second wave of opportunistic attacks on the same exposed fleet. And any verified drinking-water contamination, which CISA says has not occurred despite the pressure-loss-and-flooding effects the FBI documented, would move this from disruption with manual workarounds to a public-health event, and would likely force emergency federal mandates on the roughly 10,000 exposed PLCs Censys quantified.

Timeline

  1. original reporting

    US Water-Sector Campaign Now Confirmed in 12 States — Georgia's Clayton County Confirms Disruption as FBI Details PLC Tampering

    securityweek.com · 70d ago · August 5th, 2026

    Minnesota attacks covered Jul 28–Aug 4 (scope: 7 states as of Aug 3). New today: ABC News reports at least 12 states affected; Clayton County Water Authority (GA) confirms a disruption with reduced water pressure, and the FBI publishes operational-impact details.

    The campaign that hit 30+ Minnesota community systems July 26–27 now spans at least 12 states per ABC News, though most affected states remain unnamed. New official confirmation: Clayton County Water Authority, Georgia experienced "a temporary disruption affecting a portion of its operational systems and water service" — reduced water pressure in some areas, service restored within hours. Michigan and South Dakota had previously confirmed incidents.

    The FBI's alert details the tradecraft: attackers target internet-exposed Rockwell MicroLogix 1100/1400 PLCs, changing IP addresses and setting passwords to cause "loss of view, and in some cases function" of connected equipment; at least one organization found modified PLC project files (ladder-logic discrepancies across sites), and reported operational effects include loss of pressure and flooding — pressure loss can allow untreated groundwater to seep into pipes. Attribution to Iran remains preliminary and unconfirmed by the US government; no significant disruption or drinking-water safety impact has been reported.

    Action: Water/wastewater operators: audit for internet-exposed and cellular-connected PLCs (Censys counted ~10,000 exposed Rockwell/Siemens/Schneider units), enforce VPN-gated remote access with changed credentials, and monitor MicroLogix 1100/1400 devices for configuration drift (IP/password changes, ladder-logic edits).

  2. update from cisa.gov

    Rockwell Automation Logix Controllers (Update A) - CISA ICS Advisory ICSA-21-056-03

    cisa.gov · 2057d ago · February 25th, 2021

    CISA's ICS advisory for CVE-2021-22681, originally published February 25, 2021 and revised March 18, 2021. It documents the verification-key authentication bypass in RSLogix 5000 and Studio 5000 Logix Designer affecting CompactLogix, ControlLogix, DriveLogix, GuardLogix and SoftLogix controllers, co-discovered by researchers at Soonchunhyang University, Kaspersky, and Claroty (Sharon Brizinov and Tal Keren). Rockwell determined the vulnerability cannot be mitigated with a patch and recommended network segmentation, blocking TCP 44818 from outside the ICS network zone, CIP Security deployment, and monitoring of controller change logs.

  3. update from nvd.nist.gov

    NVD detail record for CVE-2021-22681

    nvd.nist.gov · 2050d ago · March 3rd, 2021

    The NVD entry for CVE-2021-22681, published March 3, 2021 and last modified June 17, 2026, describes the flaw in Rockwell Studio 5000 Logix Designer and RSLogix 5000 where a key used to verify Logix controller communications can be bypassed. It maps the issue to CWE-522 (Insufficiently Protected Credentials) and cites CISA advisory ICSA-21-056-03 and the KEV catalog as references. The June 2026 modification shows the record was still being maintained weeks before the water-sector campaign began.

  4. update from cisa.gov

    CISA Known Exploited Vulnerabilities Catalog entry for CVE-2021-22681

    cisa.gov · 223d ago · March 5th, 2026

    CISA added CVE-2021-22681 to the Known Exploited Vulnerabilities catalog on March 5, 2026 with a required-action due date of March 26, 2026 under BOD 22-01, citing an insufficient protected credentials vulnerability in multiple Rockwell products. It links the Rockwell support advisory (answer 1130301), ICSA-21-056-03, and NVD as sources.

  5. update from securityweek.com

    Coordinated OT Attacks Target 30+ Minnesota Water Utilities — Iranian PLC Activity Profile Matches

    securityweek.com · 77d ago · July 29th, 2026

    A coordinated cyberattack disrupted water and wastewater systems across more than 30 Minnesota communities on July 26-27, triggering a multi-agency state and federal investigation. What happened:

    • Attackers targeted operational technology (OT) systems at water utilities across Minnesota, affecting cities including Maple Plain, Braham, South St. Paul, and Plymouth

    • The City of Braham briefly took its water plant offline after "attackers shut down the operating controls, which shut down the well and water treatment plant"

    • Plymouth noted impact was "limited to equipment connected via cellular communications within the system"

    • All affected cities confirmed drinking water remains safe and services are operational

    • In most cases, contingency procedures were activated and operations continued

    Attribution assessment:

    • No formal attribution has been made, but the timing closely aligns with the July 22 update to CISA Advisory AA26-097A, which warned about Iranian-affiliated PLC exploitation activity targeting Rockwell Automation, Schneider Electric, and Siemens devices

    • The advisory was expanded to document project file exfiltration for the first time and added detection guidance for manipulation of reusable code modules embedded in PLC programs

    • CVE-2021-22681 (CVSS 9.8) — a critical authentication bypass in Rockwell Automation Logix controllers with no available vendor patch — was added to CISA KEV in March 2026 following confirmed Iranian-affiliated exploitation

    • Iranian threat groups CyberAv3ngers and Handala fit the targeting profile

    • The cellular vector aligns with 2020 Israeli water facility attacks linked to Iranian actors exploiting vulnerable cellular routers

    Defender takeaways:

    • Remote SCADA assets (water towers, lift stations, pump stations) connecting over cellular modems are often overlooked in risk assessments — integrator-built infrastructure increases this blind spot

    • Internet-exposed PLCs are being actively probed by Iranian-linked groups; CISA AA26-097A should be mandatory reading for OT security teams

    • The same vulnerabilities "almost certainly exist in water infrastructure well beyond Minnesota" according to BreachLock founder Seemant Sehgal

  6. mentioned by bleepingcomputer.com

    Minnesota Water Utilities Attack — New BleepingComputer Reporting

    bleepingcomputer.com · 76d ago · July 30th, 2026

  7. update from securityweek.com

    CISA Issues Water Sector Alert: PLC Attacks Causing Boil-Water Notices and Lockouts

    securityweek.com · 75d ago · July 31st, 2026

    New today: CISA publishes a sector alert (July 30) documenting attacker tactics and fresh targeting data.*

    CISA warned water and wastewater operators of a significant increase in threat actors targeting PLCs, citing attacks that have resulted in "boil water notices" and sustained manual operations — mirroring what Minnesota utilities reported this week after the July 26–27 coordinated attacks on 30+ community water systems. Tactics documented by CISA:

    • Attackers modify PLC passwords to lock out operators

    • Attackers change device IP addresses to disconnect PLCs from monitoring

    • Targeting spans water entities of all sizes, including orgs with mature cyber programs

    • Cellular modems installed by operators, vendors, or integrators may be undocumented and missed by attack-surface scans — the likely entry vector in Minnesota

    Recommended actions: Remove publicly exposed PLCs from the internet; route remote access through VPN/gateway only; enable password protection and change defaults; allowlist engineering-laptop IPs; and keep known-clean PLC image backups in case of password lockout (Rockwell MicroLogix 1400 owners have dedicated restoration guidance).

  8. update from cyberscoop.com

    Minnesota Water Attacks: Trump Blames the State as Censys Quantifies 10,000+ Internet-Exposed PLCs

    cyberscoop.com · 74d ago · August 1st, 2026

    New today: the president's Friday remarks and industry pushback, plus Censys exposure data attached to CISA's PLC alert.*

    The political and technical fallout from the July 26–27 attacks on 30+ Minnesota community water systems continued Friday. President Trump told reporters the state was "behind it" and "grossly incompetent," disputing the Iran attribution — drawing immediate pushback from across the cyber community: Chris Wysopal ("Victim blaming in cyber is so 2000 and late"), Jake Williams ("His own intelligence services are attributing this to Iran"), and WaterISAC's Tom Dobbins, who said the sector is "confident in our government partners' assessment" tying the activity to CISA/FBI advisory AA26-097A (Iranian-affiliated actors exploiting PLCs). Gov. Tim Walz blamed DOGE cuts to CISA for leaving the U.S. Attribution experts (Bryson Bort, ex-FBI's Cynthia Kaiser) uniformly backed the Iran assessment, calling the attacks "a target of opportunity," not state-level negligence. Separately, Censys quantified the attack surface behind CISA's urgent alert on internet-exposed PLCs: 4,100+ Rockwell Automation/Allen-Bradley hosts, 4,100 Siemens hosts, and 2,000+ Schneider Electric hosts reachable over the public internet — many MicroLogix 1400 units running end-of-sale firmware, and nearly half of exposed Rockwell devices reachable via cellular networks (Verizon, AT&T, T-Mobile, Comcast, Charter, Starlink), matching the undocumented-cellular-modem vector CISA flagged in Minnesota. WaterISAC's confidence in Iran attribution underscores that this is an active, ongoing targeting campaign, not a one-off.

  9. update from securityweek.com

    US Water Cyberattacks Extend Beyond Minnesota to at Least 7 States — Michigan, South Dakota, Georgia Confirm Incidents

    securityweek.com · 72d ago · August 3rd, 2026

    Reporting today establishes:

    • At least seven states are now known to be affected, per mainstream outlets citing sources; Georgia is named by ABC News, with the other states unnamed at publication time. - Michigan officially confirmed that a "small number" of communities saw malicious cyber activity, stating all systems operated safely with no public health concerns. - WaterISAC circulated a report (obtained by Wired, marked TLP:Amber and not intended for public release) in which Minnesota's Fusion Center found the attacks "aligned" with hacking campaigns previously linked by the US to Iran. Infracritical maintains a continuously updated technical summary for OT defenders. Review AA26-097A IOCs and Infracritical's report for hunt leads.

  10. mentioned by securityweek.com

    Jersey, Alabama Join States Targeted in Water Cyberattacks

    securityweek.com · 64d ago · August 10th, 2026

  11. update from securityweek.com

    Water Campaign Expands: New Jersey and Alabama Utilities Join the Target List

    securityweek.com · 64d ago · August 11th, 2026

    Two New Jersey water systems — Cape May and Woodbine — were targeted in cyberattacks on July 27, and Alabama utilities have now reported similar activity, expanding the multi-state campaign beyond the states already disclosed. The New Jersey systems appear to have suffered only phone-system disruption, but the campaign's steady geographic spread argues for treating every internet-facing ICS controller as an active beachhead.

Covered in

digest 2026-08-05

Source on GitHub