Loading story…
More than 30 Minnesota community water systems reportedly suffered a coordinated intrusion into their operational-technology environments, disrupting remote monitoring and forcing some utilities to operate manually. Attackers reportedly reached internet-exposed programmable logic controllers (PLCs) through cellular gateways, changed controller IP addresses and passwords, and deprived operators of visibility into affected equipment.
Authorities have not confirmed the vulnerability or equipment involved at most affected utilities. The incident nonetheless highlights the risk from publicly reachable OT assets, including exposed Rockwell Logix controllers affected by the actively exploited, unpatched authentication-bypass vulnerability CVE-2021-22681; utilities should remove public OT exposure, segment networks, harden remote access, monitor configuration changes, and maintain tested manual fallback procedures.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
CVE-2021-22681, a CVSS 9.8 authentication-bypass vulnerability affecting Rockwell Automation Logix controller families, was disclosed. The weakness stems from insufficient protection of a cryptographic key that can allow a client posing as Studio 5000 Logix Designer to be treated as trusted.
Senators Schiff and Klobuchar introduced the proposed Water Cyber Shield Act. The bill would authorize EPA cybersecurity assessments and corrective actions for water and wastewater systems, with proposed authorization of $300 million annually, but it has not become law.
The National Rural Water Association and DEFCON Franklin announced the Water Watch Center, formalizing a two-year pilot that placed roughly 450 volunteer security researchers with small utilities in seven states. The initiative also includes managed detection and response threat-intelligence sharing and a Vanderbilt/DARPA CASTLE digital-twin research partnership.
A coordinated intrusion reportedly affected operational-technology environments at more than 30 Minnesota community water systems. Some utilities lost remote communications with water towers and lift stations, switched to manual operations, and one utility temporarily took its water-treatment plant offline; four utilities publicly disclosed effects, including one that declared a local emergency.
CISA added CVE-2021-22681 to its Known Exploited Vulnerabilities Catalog. Rockwell Automation reportedly has no complete patch because the issue is rooted in the protocol's authentication design.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cyberattack on the Municipal Water Authority of Aliquippa in Pennsylvania exposed a broader campaign targeting **Unitronics Vision Series PLCs** used in water and wastewater operations. Attackers linked to the pro-Iran **Cyber Av3ngers** group reportedly defaced facility screens and disrupted a remote water pressure station, prompting operators to take affected equipment offline and switch to manual or backup processes; officials said drinking water quality and core service were not affected because the compromised system was isolated from the main treatment plant. Reporting also cited a separate incident at a North Texas utility, underscoring concern that internet-exposed industrial control systems are being actively targeted across the sector. U.S. and Irish authorities later tied similar activity to exploitation of weakly secured or internet-accessible Unitronics controllers, including default or poor password practices and the vulnerability tracked as `CVE-2023-6448`, which was added to CISA's Known Exploited Vulnerabilities catalog. In Ireland, attackers disrupted water service to about 160 households in County Mayo after compromising a PLC at a private group water scheme. CISA warned water operators to remove PLCs from direct internet exposure, change default credentials, enforce multifactor authentication where possible, and back up device configurations as officials and experts warned that undersecured operational technology poses an ongoing risk to critical infrastructure.
Jun 29, 2026
Government and industry reporting warns that operational technology and industrial control systems remain dangerously exposed through weak remote access, poor segmentation, and internet-facing devices, giving both state-backed and criminal actors paths into critical infrastructure. A joint **CISA/NSA** advisory said adversaries routinely exploit legacy OT environments, public system information, and insecure remote connections to move from reconnaissance to manipulation of physical processes, while a separate **CISA/FBI** alert tied Chinese state-sponsored intrusions to U.S. natural gas pipeline operators and said the actors stole SCADA and ICS information to build capabilities for future disruption. Recent exposure research also found **6,300** internet-reachable industrial-control and building-automation devices near U.S. data centers, including **BACnet**, **Fox/Niagara**, **Modbus**, and Vertiv/Liebert systems that could affect cooling and power operations. The threat has already translated into real-world disruptive activity and increasingly specialized tooling. Dragos reported **FrostyGoop**, a Golang-based ICS malware that communicates over **Modbus TCP** and was likely used to disrupt heating services in Lviv, Ukraine, after attackers apparently entered through an internet-facing router and traversed poorly segmented networks. Other cited incidents and assessments include Israel’s thwarted attempt against water facilities, persistent Russian probing of U.S. power infrastructure, and leaked-document analysis describing a Russian capability designed to attack rail and petrochemical control systems through telecommunications access. Across the reporting, the common defensive priorities were to eliminate direct public exposure, harden and inventory remote access, enforce MFA, replace default credentials, patch supported systems, restrict engineering tools, and closely monitor OT network and protocol activity.
Aug 15, 2026
Rockwell Automation, Siemens, and Schneider Electric issued July industrial security advisories covering dozens of OT vulnerabilities, with Rockwell disclosing multiple high-impact flaws in control and I/O products. The most severe Rockwell issue, **CVE-2026-10577**, affects `1715 Redundant IO` and exposes a network-accessible debug port without authentication, allowing remote attackers to run intrusive CLI commands, read or delete files, stop tasks, modify memory, and change I/O states; the flaw carries a **CVSS v4.0 score of 10.0**. Rockwell also reported **CVE-2026-9636**, a CIP Security certificate revocation handling weakness in several `CompactLogix 5380`, `ControlLogix 5580`, `GuardLogix 5580`, and `1756-EN4` devices that could let a network attacker connect with a certificate that should no longer be trusted, and **CVE-2025-11698**, a buffer overflow in Logix controller recovery images that can trigger a major non-recoverable fault and cause denial of service. Separately, CERT VDE published **VDE-2026-031** for **CVE-2026-4769**, a critical **WAGO System I/O Field** vulnerability caused by an undocumented internal diagnostic function exposed without authentication during early boot. An unauthenticated remote attacker can exploit the startup window to access internal system processes and fully compromise affected `0765-series` devices; the issue is rated **CVSS 3.1 9.8** and **CVSS 4.0 9.3**. Siemens also disclosed **CVE-2025-40945**, an untrusted search path flaw in the IAM Client SDK used across products including `COMOS`, `Designcenter NX`, `Simcenter`, `Solid Edge`, `Teamcenter Visualization`, and `Tecnomatix`, enabling local privilege escalation for authenticated users and reinforcing the breadth of current patching demands across industrial environments.
Jul 17, 2026