# CISA warns of PLC attacks on water utilities

Published: 2026-07-30 · Severity: high · Sectors: infrastructure
Canonical: https://vorant.io/reports/d839acf5-0857-5395-9749-8c1e86f269f8/cisa-warns-of-plc-attacks-on-water-utilities

> CISA reports a surge in attacks against internet-exposed PLCs in the water sector, with actors locking out operators and disrupting service.

CISA has issued an alert describing a marked increase in threat activity targeting programmable logic controllers (PLCs) within the Water and Wastewater Systems Sector. Attackers are gaining access to publicly exposed PLCs and OT devices—including undocumented cellular modems installed by vendors or integrators—then changing default or existing passwords to lock out legitimate operators and altering IP configurations to sever remote connectivity. This activity has already caused boil water notices and forced some utilities into sustained manual operations, indicating real operational impact rather than opportunistic defacement alone.

The advisory notes that targeting is indiscriminate across utility size and maturity, meaning even organizations with established cybersecurity programs may be exposed via undocumented remote-access hardware that falls outside routine attack surface scans. CISA specifically references Rockwell Automation MicroLogix 1400 controllers, pointing operators to vendor guidance for recovering access when passwords have been changed by an unauthorized party.

Mitigation guidance focuses on immediately removing PLCs from direct internet exposure, routing remote access through VPNs or gateway devices, enforcing password protection, and allowlisting IPs to known engineering assets. CISA also recommends maintaining clean PLC image backups in case of lockout. No specific threat actor, malware, or CVE has been attributed to this activity; the alert is a sector-wide warning based on observed operational patterns rather than a single confirmed intrusion set.

## Detection guidance (public sample)

### External Source Connecting to Exposed PLC/ICS Management Ports

ATT&CK: T1190

Detects inbound connections from non-internal (public/external) IP space to well-known ICS/PLC management and engineering protocol ports, indicating a PLC directly reachable from the internet — the initial access vector described in the CISA advisory. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: External Source Connecting to Exposed PLC/ICS Management Ports
description: Flags connections to common ICS/PLC engineering and management protocol
  ports (EtherNet/IP CIP, Modbus, DNP3, S7comm) originating from outside private/internal
  address space. Generalises on the exposed-service behaviour described in the CISA
  water-utility PLC advisory rather than any specific actor IP.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: network_connection
detection:
  selection:
    DestinationPort:
    - 44818
    - 502
    - 102
    - 20000
    - 2404
  filter_internal_src:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 169.254.0.0/16
  condition: selection and not filter_internal_src
falsepositives:
- Legitimate remote vendor/integrator support sessions that have not yet been routed
  through a VPN or jump host
- Misconfigured network taps or SPAN ports that report internal traffic with public-looking
  source addresses
level: high
id: 83c593e1-ecf4-581d-90db-fcf97f4ed74f
status: experimental
author: Vorant
```

### Remote Access Service Reachable From External Network Without VPN Termination

ATT&CK: T1133

Detects successful inbound connections to remote-access/administration ports (RDP, VNC, cellular-modem web admin, SSH) on OT-segment hosts from external source IPs, matching the advisory's finding of undocumented cellular modems and other remote-access hardware providing direct internet reachability to control-system assets. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Remote Access Service Reachable From External Network Without VPN Termination
description: Detects external (non-private) source IPs establishing connections to
  common remote-management ports (RDP, VNC, SSH, HTTP/HTTPS admin) on hosts inside
  OT/ICS network ranges. Intended to surface undocumented cellular modems or other
  remote-access hardware that bypass the corporate VPN/gateway, as described in the
  CISA water-sector PLC advisory.
tags:
- attack.initial_access
- attack.t1133
logsource:
  category: network_connection
detection:
  selection:
    DestinationPort:
    - 3389
    - 5900
    - 22
    - 80
    - 443
    Initiated: true
  filter_internal_src:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  filter_known_vpn_gateway:
    DestinationIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection and not filter_internal_src and not filter_known_vpn_gateway
falsepositives:
- Authorized vendor remote-support connections to engineering workstations that are
  intentionally dual-homed
- Site-to-site VPN endpoints whose termination IP falls outside documented internal
  ranges
level: medium
id: 4c790f86-3ecd-526c-8261-e93ced86c92c
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d839acf5-0857-5395-9749-8c1e86f269f8/cisa-warns-of-plc-attacks-on-water-utilities.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup