CISA tally widens scope of July targeting against US water systems

More than 100 internet-exposed systems in the US water and wastewater sector were targeted during July, according to subsequent CISA guidance reproduced by SecurityWeek and The Register. The disclosure, reported on 26 August, is the first public federal nationwide count for the campaign. The guidance said the activity commonly involved programmable logic controllers connected directly to cellular modems.

That count describes targeted systems, not distinct utility operators, confirmed intrusions or disrupted facilities. CISA has not disclosed how many systems attackers successfully accessed, how many utilities those systems represented or how many experienced operational effects. Data access across the aggregate campaign also remains unknown.

Successful unauthorised access is confirmed in at least some incidents. In its 30 July bulletin, CISA said attackers had changed PLC passwords, locking some operators out of their equipment. Attackers also altered PLC IP addresses, disconnecting affected controllers from expected network access. Those actions confirm malicious activity in affected environments, but do not reveal the success rate across the wider set of targets.

CISA said the activity resulted in boil-water notices and sustained manual operations, although it did not provide a complete tally of affected facilities or customers. Public evidence does not show that every targeted system was accessed or that every organisation suffered disruption. It also does not establish drinking-water contamination or confirmed public-health harm.

The common risk condition is direct internet exposure, not a version-specific product flaw. Cellular modems installed by operators, vendors or systems integrators can create an external path to operational technology while remaining absent from normal asset inventories and attack-surface reviews. Once controllers are publicly reachable, attackers may be able to alter device credentials and network settings.

No named CVE, zero-day or common vendor defect has been established for the July campaign. Weak or default credentials have not been proven across every incident, and CISA has not identified affected or unaffected product versions. The response is therefore mitigation-only: no campaign-specific patch or fixed product version has been identified.

The attribution picture is similarly incomplete. The Washington Post reported that US and state officials suspected Iranian hackers were probably responsible for attacks on Minnesota water facilities. WIRED separately cited Tenable researchers who considered the operational pattern consistent with CyberAv3ngers or associated groups, while an unnamed Claroty analyst cited by the publication pointed to possible Handala involvement. Those assessments have not been independently verified, and CISA’s 30 July bulletin did not name an actor.

CyberAv3ngers does have a separately established historical connection to Iran’s Islamic Revolutionary Guard Corps. A joint advisory from CISA and partner agencies, first published in 2023 and updated in 2024, identified it as an IRGC-affiliated persona involved in an earlier campaign against internet-connected Unitronics PLCs and human-machine interfaces. That historical attribution does not prove that CyberAv3ngers, the IRGC or Iran was responsible for all of the July 2026 activity.

CISA’s defensive guidance begins with removing PLCs and other operational technology from direct public exposure wherever possible. Operators should inventory every external connection and validate cellular links installed by operators, vendors or systems integrators. Necessary remote access should sit behind controlled gateways, jump hosts or VPN infrastructure, with access restricted to authorised source systems.

The agency also recommends replacing default or weak credentials, using multifactor authentication where supported, applying available vendor security updates, filtering traffic with firewalls or access-control lists, and monitoring PLC, modem and network logs. These are defensive measures, not a CVE-specific fix.

The same exposure issues matter outside the US. Undocumented cellular links, publicly reachable controllers and third-party remote-access paths are relevant to Australian water providers and other critical-infrastructure operators. No public evidence reviewed for the campaign connects it to an Australian victim.

The Hack Academy’s 2 August report covered the same campaign when the publicly reported scope was at least seven US states and the Iran connection remained unresolved. The material update is the federal count of more than 100 targeted systems and the emphasis on cellular-connected PLCs. Federal agencies have yet to publish the number of successful intrusions, a definitive victim or state list, an incident-level impact assessment, or final attribution for the aggregate campaign.