Iranian hackers escalate U.S. water system attacks

Cyberattacks on U.S. water systems have increasingly targeted operational technology (OT) environments, particularly programmable logic controllers (PLCs) from major vendors like Rockwell, Siemens, and Schneider Electric. By exploiting exposed internet-facing devices with weak passwords and outdated firmware, hackers have compromised over 100 water utilities, including more than 30 in Minnesota alone. These intrusions often leverage AI-augmented tools to develop attack scripts, enabling adversaries to modify PLCs to disable shutdown processes and alarms, thereby creating unsafe conditions without operator awareness.

The nature of cyberattacks on water infrastructure has evolved from opportunistic defacements and ransomware extortion to more destructive tactics aimed at disrupting physical processes and permanently damaging critical operational data. Groups like Hydro Kitten have engaged in politically motivated defacements, while suspected Iranian state-sponsored actors have conducted persistent campaigns across more than a dozen states, pre-positioning within systems to enable future disruptive or destructive operations. This shift underscores a growing willingness among sophisticated threat actors to directly impact essential public services beyond traditional IT network intrusions.

As OT environments become increasingly interconnected with corporate networks and the internet, the attack surface has expanded significantly, necessitating enhanced cybersecurity measures. Experts like Adam Meyers emphasize the urgent need to eliminate direct internet exposure of OT systems, enforce strong password policies, and implement mitigating controls such as network segmentation and continuous monitoring. This proactive approach is critical to counter the evolving threat landscape where attackers exploit basic vulnerabilities rather than relying solely on zero-day exploits.

The shift from extortion-driven attacks to those focused on disruption and physical impact represents a new cybersecurity reality for water utilities, highlighting the critical importance of securing OT infrastructure. While recent breaches have caused outages and operational disruptions, they have yet to significantly affect water supplies, serving as a warning of the potentially severe consequences if attackers succeed in manipulating water flow or treatment processes. This evolving threat landscape demands modernization efforts and advanced defensive measures to safeguard public health and safety.

The persistent vulnerabilities in U.S. water system OT infrastructure stem largely from decades-old legacy equipment and underfunded municipal utilities that struggle to keep pace with cybersecurity demands. As Janet from Minnesota water systems lamented, 'fixing the legacy would take a huge heavy lift because we aren't... good at keeping up... decades of legacy... coming home to roost.' These small utilities, often operating with minimal staff who juggle multiple roles, face significant challenges modernizing their control systems while maintaining operational continuity.

Exposed programmable logic controllers (PLCs), which operate pumps and valves, represent a critical attack surface due to their direct internet connectivity and weak security configurations. Hackers exploit default or weak passwords—such as 'password' or '1234'—and unpatched vulnerabilities to gain unauthorized control, as highlighted by the 2023 Iranian-linked attacks on Unitronics PLCs and the discovery of over 4,000 Rockwell Automation devices online. Tools like Shodan make these devices easily discoverable, underscoring the risks of internet-facing OT systems that were originally designed to run in isolation.

The reliance on remote access for operational efficiency further exacerbates security gaps, especially in smaller utilities with limited cybersecurity expertise. Many systems depend on direct internet connections or publicly accessible cellular networks without sufficient protective barriers such as firewalls, multi-factor authentication, or strict allow lists. As Gabriel Collins noted, this dependence on third-party contractors and remote diagnostics expands the attack surface, making these water systems vulnerable to infiltration and manipulation.

Iranian-affiliated threat actors, notably the Islamic Revolutionary Guard Corps and proxy groups like the Cyber Avengers, have escalated their asymmetric warfare tactics against U.S. water systems and critical infrastructure since 2022. Initially conducting low-level defacements and probing, these actors have advanced to highly sophisticated disruption campaigns targeting operational technology components such as programmable logic controllers that regulate water treatment chemicals, aiming to disrupt water safety and availability rather than steal data or deploy ransomware. This strategic shift underscores a preference for causing operational chaos and geopolitical signaling over financial gain or data exfiltration.

These Iranian cyber operations exploit systemic vulnerabilities endemic to smaller municipal and county water systems, which often suffer from legacy OT infrastructure, minimal cybersecurity staffing, and poor cyber hygiene including default or weak passwords and internet-facing devices. Leveraging AI tools to rapidly scan and identify exposed programmable logic controllers and human-machine interfaces, Iranian actors conduct coordinated attacks across multiple states—affecting over 30 facilities in Minnesota alone—without relying on custom malware, instead manipulating device configurations to cause disruption. This opportunistic targeting of underprotected critical infrastructure amplifies the geopolitical impact by threatening essential lifeline services and eroding public trust.

Beyond water systems, Iranian-affiliated groups have demonstrated a broader campaign of asymmetric cyber warfare targeting critical infrastructure globally, as evidenced by the IRGC-linked shutdown of a UK power station for four days in 2026. The integration of AI in these operations lowers barriers to entry, enabling attackers to identify vulnerabilities faster and scale attacks across multiple assets, disproportionately affecting smaller operators who often fall outside mandatory cyber-reporting thresholds. Experts like e2e-assure CEO Rob Demain and Huntress vCISO Muhammad Yahya Patel warn that this trend demands enhanced national-level collaboration and resilience strategies to counter the escalating geopolitical conflict manifesting through cyber means.

The evolving tactics of Iranian threat actors also include leveraging legitimate administrative access vectors, such as Microsoft Intune and Entra ID, to conduct destructive operations against U.S. companies with military contracts, exemplified by the Handala hacktivist group's attack on medical technology firm Stryker. This reflects a broader shift from financially motivated cybercrime to geopolitical signaling and disruption, compelling organizations to model war and geopolitical conflict as integral enterprise risks. As noted by cybersecurity analysts, wartime attackers often seek disruption and destruction rather than data or ransom, necessitating a reevaluation of traditional risk frameworks in the face of coordinated nation-state cyber operations synchronized with geopolitical events.

Federal agencies including the FBI, EPA, and CISA have issued urgent advisories emphasizing the immediate removal of programmable logic controllers (PLCs) and other operational technology (OT) devices from direct internet exposure, advocating for the use of secure gateways, firewalls, and strict access control lists to limit communications only to authorized devices. These recommendations also stress the importance of strong, unique passwords and securing cellular modems with robust authentication and regular log reviews to detect suspicious activity, reflecting a comprehensive approach to reducing attack surfaces in water system OT infrastructure.

The persistent exposure of critical water infrastructure, despite stringent state laws like New Jersey’s Water Quality Accountability Act, reveals significant enforcement and verification gaps that undermine cybersecurity efforts. Experts warn that security plans alone are insufficient without continuous, proactive verification of network exposures, as evidenced by thousands of industrial controllers still reachable from the public internet, underscoring the urgent need for modernization and bridging the IT-OT divide to defend against increasingly sophisticated nation-state threats.

Industry leaders and coalitions, such as the Operational Technology Cybersecurity Coalition led by Tatyana Bolton, are calling on Congress to enact binding operational directives on OT security, reauthorize and fund the State and Local Cybersecurity Grant Program, and extend the Cybersecurity Information Sharing Act to provide sustained resources and regulatory authority. This push reflects recognition that many small municipal water utilities lack dedicated cybersecurity staff and resources, creating a dangerous mismatch in defending critical infrastructure against advanced adversaries.

Given the limitations of legacy OT systems that cannot be easily patched or upgraded without risking operational downtime, cybersecurity experts advocate for a collaborative, informed approach where IT professionals first gain granular understanding of OT environments before implementing changes. When modernization is not immediately feasible, compensating controls such as network isolation, behavioral anomaly detection platforms from vendors like Dragos and Claroty, and rigorous monitoring become essential to close the 'OT visibility crisis' and detect stealthy attacks that exploit legitimate credentials within authenticated sessions.