Over 100 US water utilities had cyberattacks in July, says CISA

The Cybersecurity and Infrastructure Security Agency (CISA) reported that more than 100 internet-exposed water systems were attacked in July.

Previous reports said the attacks were on water systems in 12 states. While no more information on where the attacks took place was released, the agency said the attackers typically targeted programmable logic controllers (PLCs) connected directly to a cellular modem in the guidance CISA issued.

CISA said all organizations in the water and other critical infrastructure sectors should route all necessary remote access through a secure gateway, firewall, VPN, or other centrally managed access solution, as opposed to connecting directly to a PLC, human-machine interface (HMI), or remote terminal unit (RTU).

The guidance from CISA comes on the heels of reports Aug. 26 that water-sector supplier Micro-Comm had nearly 850,000 files leaked by attackers.

While Iran-linked actors are suspected of the vast majority of the July attacks on water systems, Micro-Comm and the FBI said responsibility for the most recent incident was claimed by Barracuda, a relatively new ransomware group that claims it’s motivated by profit and not government sponsored.

“The Micro-Comm attack demonstrates that protecting the water utility itself is only half the problem,” said Kevin Surace, chief executive officer of TokenCore. “Attackers can go after the companies that manufacture, configure, maintain, and remotely support the technology inside hundreds of utilities.”

Surace added that the most important recommendation from CISA is to get OT off the public internet when it does not absolutely need to be there. Surace said CISA was right to call for reducing exposure, using secure gateways, patching systems, and continuously monitoring traffic.

Denis Calderone, chief technology officer at Suzu Labs, said recent events show how the industrial control systems threat landscape has grown much more sophisticated:

In 2023, the CyberAv3ngers were simply changing default passwords on Unitronics PLCs and putting political messages on HMI screens. But by July of this year, CISA confirmed that actors were exfiltrating PLC project files using the vendors' own engineering software and modifying add-on instructions to disable safety shutdowns while leaving the operator displays looking normal. Just last week, five federal agencies warned that attackers are using AI to generate working exploitation scripts against Siemens S7 controllers, calling it an evolution that “dramatically reduces the technical expertise and time required.”

“That’s the trajectory, and the Micro-Comm breach feeds into that narrative,” said Calderone. “What makes the Micro-Comm breach so dangerous is the stolen proprietary data. The five-agency advisory said threat actors are collecting public information about PLC vulnerabilities and using AI to generate scripts that act on it. Now, imagine what becomes possible with a non-public disclosure? There are product diagrams, system architecture documents, customer-specific configurations, details about how SCADAview CSX communicates with the controllers it monitors.”

Calderone said attackers can now hand that documentation to an unguardrailed AI model and the output is not generic Modbus reads on port 502: it's targeted tooling built against a specific vendor's implementation, informed by the manufacturer's own engineering materials.

Experts warn of a systemic risk

Matt Hartman, chief strategy officer at Merlin Group, added that the fact CISA reports more than 100 internet-exposed water systems were targeted in a single month underscores that we’re now looking at a systemic risk, not a series of isolated incidents.

“Water utilities often rely on operational technology that was never designed to be directly exposed to the internet, while attackers are also looking for weaknesses across the vendors that support these environments,” said Hartman.

Hartman said security team should prioritize what CISA has emphasized: identify internet-exposed assets, remove unnecessary exposure, change default credentials, patch supported systems, secure required remote access with controls like MFA, and continuously monitor for anomalous activity.

Danny Jenkins chief executive officer at ThreatLocker, added that the attacks CISA disclosed show that adversaries view these utilities as attractive targets because of a combination of poor defenses and the potential impact of damaging the water supply.

“Utilities should disconnect operational technology like PLCs from the public internet as quickly as possible, which means transitioning to other methods like private lines or satellite communications,” said Jenkins.