The US Cybersecurity and Infrastructure Security Agency (CISA) is urging water and wastewater system (WWS) operators to protect operational technology (OT) against malicious activity targeting programmable logic controllers (PLCs).

The alert is a fresh call to action that comes just days after a coordinated cyberattack disrupted automated controls at dozens of water utilities in Minnesota.

In an alert published July 30, CISA said it is observing a significant increase in threat actors targeting PLCs in the water and wastewater sector, and urged critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other OT from the internet as soon as possible.

The agency described specific tactics it has seen against exposed controllers: attackers have modified passwords to lock out operators and disconnected PLCs by changing their IP addresses. According to CISA, the attacks have resulted in “boil water notices” and sustained manual operations that closely mirror what several Minnesota utilities reported this week.

Notably, the alert stressed that the targeting spans water entities of all sizes, and that even organizations with mature cybersecurity programs should validate their external connections. CISA specifically called out cellular modems installed by operators, vendors, or system integrators that may not be documented or captured in routine attack surface scans.

Minnesota attacks underscore the warning

CISA’s renewed push follows a coordinated cyberattack that, according to Minnesota IT Services (MNIT), hit OT systems at more than 30 community water systems on July 26 and 27.

As SecurityWeek reported earlier this week, statements from affected cities, including Maple Plain, Braham, South St. Paul, and Plymouth, indicated that some automated control functions were disrupted, though contingency procedures were activated and water and wastewater operations remained functional in most cases. The affected cities told residents that drinking water remained safe.

State and federal agencies are investigating, and no formal attribution has been made.

Ties to the Iranian PLC campaign

The timing of the Minnesota intrusions is notable. They came shortly after the US government warned critical infrastructure organizations about Iran-linked attacks on industrial control systems made by Siemens, Rockwell Automation, and Schneider Electric.

That warning came via a July 22 update to advisory AA26-097A, originally published in April, which expanded the list of targeted vendors beyond Rockwell Automation’s Allen-Bradley controllers to include Schneider Electric and Siemens devices, and noted that PLCs from other manufacturers may also be at risk. Investigators have observed activity against Rockwell CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 series PLCs.

Iranian threat groups including CyberAv3ngers and Handala fit the profile for attacks on water systems of the kind seen in Minnesota, though investigators have not linked the incidents to any specific actor. CyberAv3ngers has a long track record of targeting small water utilities and municipal facilities, and in 2020 attacks on water facilities in Israel, Iran-linked actors exploited vulnerable cellular routers as an entry point.

What OT operators should do

CISA’s core message to the sector is unchanged but increasingly urgent: internet-exposed OT must be secured. The July 30 alert recommends three immediate steps. Operators should disconnect the PLC from the internet, routing any remote access for operational purposes through a VPN or gateway device rather than directly to the controller; enable password protection and change default passwords; and allowlist IP addresses so that remote access is permitted only from known engineering laptops or other critical OT assets.

CISA also advised that, after disconnecting PLCs, operators ensure they have a known-clean backup of the PLC image in case they are locked out by a modified password. Owners and operators of Rockwell Automation MicroLogix 1400 controllers are pointed to Rockwell’s dedicated guidance for restoring access when the password is unknown.

Beyond the immediate steps, utilities are encouraged to review the tactics, techniques, and indicators of compromise in AA26-097A for signs of current or historical activity on their networks. For more information, read the full alert from CISA.