CISA Warns of Cyberattacks Disrupting US Water Utilities

CISA, the EPA, the FBI, and the NSA have repeatedly warned that US drinking water and wastewater utilities are being actively compromised, and the intrusions share one uncomfortable trait: almost none of them required an exploit. Attackers are finding programmable logic controllers and human-machine interfaces sitting directly on the public internet, logging in with factory-default credentials, and manipulating the process. In the incident that triggered the original joint advisory, the Municipal Water Authority of Aliquippa, Pennsylvania, lost a booster station PLC to an attacker who left a political defacement on the screen and forced operators into manual control.

The Unitronics attack path

The CyberAv3ngers persona, which the US Treasury has publicly tied to Iran's Islamic Revolutionary Guard Corps Cyber-Electronic Command, targeted Unitronics Vision Series PLCs with integrated HMIs. These devices are common in booster stations, lift stations, and small treatment plants because they combine controller and operator screen in one inexpensive unit. That convenience is exactly what makes them dangerous when exposed.

• Discovery: Unitronics devices answer on TCP 20256 (PCOM). Internet-wide scanning services index them by the thousand, so no reconnaissance skill is required.
• Access: Many units ship with the default password 1111 and are deployed without changing it. Where the password was changed, weak or reused values were common.
• Impact: Once authenticated, an attacker can read and write logic, alter setpoints, halt the program, and rewrite the HMI display. In Aliquippa the attacker replaced the screen with a message and disabled the controller.
• Persistence: No malware was needed. Credentialed access over an exposed management port is persistence, and it survives reboots, antivirus, and EDR because none of those exist on the device.

The Russia-linked HMI manipulation

A second cluster, operating as the Cyber Army of Russia Reborn, has been observed reaching remote-access HMIs at small utilities in Texas and elsewhere and changing operational values live on camera. In Muleshoe, Texas, manipulation of tank controls produced an overflow that ran for roughly half an hour and dumped tens of thousands of gallons before staff intervened. Mandiant and others have assessed this group as connected to Sandworm, the GRU unit responsible for the Ukrainian grid attacks, which moves this out of nuisance territory. Even where the technical impact is trivial, the group posts video of the manipulation, and that footage is the actual payload: it is a demonstration that Russian-aligned operators can touch American process control at will.

Why water is the softest target in critical infrastructure

There are roughly 150,000 public water systems in the United States, and the overwhelming majority serve small communities. The EPA has reported that around 70 percent of systems it inspected were failing to meet Safe Drinking Water Act requirements, with a meaningful share exhibiting basic problems such as default passwords and single-user shared logins. The structural issues compound:

• Budget and staffing: a system serving 3,000 people typically has no dedicated IT staff, let alone OT security. The plant operator is the security team.
• Vendor remote access: integrators need to reach equipment for support, and the cheapest way to provide it is a port forward on the utility's firewall.
• Flat networks: business IT, SCADA, and field devices frequently share address space with no segmentation and no jump host.
• Unauthenticated protocols: Modbus, DNP3, and PCOM were designed for trusted serial links. Anything reachable can generally be commanded.
• No logging: most small utilities cannot answer the question 'who logged into that PLC last month' because nothing records it.

What to do this week

The remediation list from the joint advisory is unglamorous and almost entirely free. If you support a water or wastewater system, these are the actions that would have prevented every publicly documented incident in this campaign.

• Take Unitronics and all other PLCs and HMIs off the public internet. If remote access is required, front it with a VPN that enforces phishing-resistant MFA, and restrict source addresses.
• Change every default password, including 1111 on Unitronics units, and eliminate shared operator accounts.
• Change the default TCP 20256 listener to a non-standard port. This is obfuscation, not security, but it removes you from mass scan results.
• Update Unitronics PLC firmware to the current vendor release.
• Back up PLC logic and configuration, store it offline, and verify you can restore it. Aliquippa recovered by reverting to manual operation, which does not scale to a treatment process.
• Confirm manual override and failsafe procedures exist and that operators have practiced them.
• Enforce MFA on all remote access into the OT environment, including vendor and integrator accounts.

Detection and hunting

Assume exposure until proven otherwise. Scan your own external ranges for 20256/TCP and the other common ICS management ports rather than trusting the firewall documentation, because port forwards added by integrators years ago rarely appear in the asset inventory. Pull authentication and connection logs from any device that produces them and look for logins outside operator shift windows or from non-US source addresses. Alert on PLC program downloads, mode changes from RUN to STOP, and setpoint writes outside engineering change windows. Where the device cannot log, place a network sensor on the segment and baseline the traffic, since ICS protocol traffic is highly regular and unauthorized commands stand out against it.

The bottom line

Two separate state-aligned actors have demonstrated the ability to reach into American water process control and change what physical equipment does, and they did it with scanning and default credentials. The immediate consequences so far have been limited to a defaced screen, an overflowed tank, and a return to manual operation. That is the outcome of low attacker intent, not of adequate defenses. The same access that produces a taunting message on an HMI can alter chemical dosing or disable pumps, and the utilities most likely to be exposed are exactly the ones least equipped to detect it. Close the ports, kill the default passwords, and put MFA in front of remote access. Then worry about detection.