Threat Intelligence Brief
Curated summary with source attribution
Source: kcra.com
Threat Risk: High
Victim: US Municipal Water Utilities
Incident: Coordinated cyberattacks targeting internet-facing PLCs in water systems across at least six US states.
Impact: Operational disruption including boil water notices and forced transitions to manual system control.
Attacker: Suspected Iranian-linked actors
Analysis: Attackers are targeting internet-facing Programmable Logic Controllers (PLCs) with weak configurations to gain unauthorized access. By compromising these devices, threat actors can potentially manipulate water pressure and chemical dosing. This campaign underscores a critical vulnerability in how operational technology (OT) is exposed to the public internet.
Recommendations: Remove all PLCs and industrial control systems from the public internet.; Implement strong authentication and change default configurations on all OT devices.; Deploy strict network segmentation to isolate critical infrastructure from corporate networks.
Source: KCRA
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-08-01 20:54 UTC
Coordinated cyberattacks against water systems in Minnesota and six other US states. Disruption of water operations, including loss of pressure and physical flooding. The attacks specifically targeted Programmable Logic Controllers (PLCs), allowing attackers to bypass traditional IT security layers and directly manipulate physical equipment. By gaining access to operational technology (OT), the actors caused tangible disruptions including water pressure loss and flooding. This pattern of targeting critical infrastructure aligns with known Iranian cyber operations aimed at creating societal panic.
Corroborating source: nypost.com
Update — 2026-08-02 20:14 UTC
Unauthorized access to water infrastructure monitoring systems to manipulate pressure and alarms. Potential contamination of public water supplies and degradation of system safety monitoring. The attack targeted industrial monitoring systems across several US states, focusing on the manipulation of water pressure to allow groundwater infiltration. This indicates a targeted effort to compromise the physical safety of water supplies via digital access. The operation likely reflects state-sponsored retaliation tactics targeting critical infrastructure.
Corroborating source: newstalkzb.co.nz
Update — 2026-08-03 20:45 UTC
Unauthorized access to water system monitoring systems to manipulate pressure and alarms. Potential contamination of water pipes through groundwater intrusion. Attackers targeted computer systems responsible for monitoring water infrastructure across several US states. By disabling alarms and manipulating water pressure, the actors attempted to compromise the purity of the water supply. This incident underscores the vulnerability of ICS/SCADA systems to nation-state actors during geopolitical tensions.
Corroborating source: iheart.com
Update — 2026-08-07 16:50 UTC
Unauthorized access to water system controls across over 100 US municipalities. Potential disruption of essential drinking water services and degradation of public safety. Iranian-linked threat actors are systematically targeting municipal water infrastructure across more than 100 US locations. These intrusions exploit long-standing vulnerabilities in industrial control systems to gain strategic footholds. The campaign signals a shift toward targeting high-impact critical infrastructure for geopolitical leverage.
Corroborating source: nytimes.com
Update — 2026-08-10 15:10 UTC
Cyberattacks on programmable logic controllers (PLCs) across water systems in 12 US states. Loss of system control and monitoring, leading to boil water notices and the need for manual operations. Attackers are bypassing traditional IT networks to target Operational Technology (OT), specifically Rockwell Automation and Allen-Bradley PLCs. By seizing control of these industrial controllers, threat actors can manipulate water pressure and chemical treatment levels. This shift toward physical impact marks a dangerous escalation in critical infrastructure targeting.
Corroborating source: wellsvillesun.com
Update — 2026-08-13 22:47 UTC
A cyberattack targeted the operational technology of more than 30 community water systems in Minnesota. The attack caused temporary equipment malfunctions but resulted in no major service disruptions or ransom demands. The attack targeted operational technology (OT) across over 30 water utilities, causing temporary equipment malfunctions. The coordination between CyberAv3ngers and APT IRAN suggests a state-sponsored effort to probe vulnerabilities in critical US municipal infrastructure. While major disruptions were avoided, the incident demonstrates a persistent intent to target life-sustaining services.
Corroborating source: kstp.com
Update — 2026-08-17 06:49 UTC
Coordinated cyberattacks targeting remote management equipment of water systems across multiple US states. Temporary disruption and degradation of water utility operations. Threat actors are exploiting aging industrial control systems and weak authentication methods in US water utilities to gain remote access. While drinking water supplies remain intact, the deployment of malware has degraded operational capabilities in several states. This pattern suggests a strategic effort to signal capability and undermine public trust in essential government services.
Corroborating source: middle-east-online.com