Water OT Attack Targeting Public PLCs: Locking Out Operators via Password and IP Changes
Water OT Attack Targeting Public PLCs: Locking Out Operators via Password and IP Changes 1. Basic Information Article Title : CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs Source : CISA Publication Date : 2026-07-30 Severity : Emergency Original Link : https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs Related Malware : None Threat Actor : Actors targeting public PLCs (This alert does not attribute the activity to a specific group) CVE : None Products & Environment : Water/Wastewater OT, PLC, Rockwell Automation MicroLogix 1400, cellular modem, VPN/gateway Related Sources BleepingComputer Report CISA AA26-097A (Updated 2026-07-22) 2. Summary An attack that disrupts water operations by changing management settings on PLCs directly exposed to the Internet, locking out operators with new passwords, and disconnecting devices by changing IP addresses. 3. Attack Flow Tampering with Public PLC Settings Attackers search for PLCs exposed to the Internet or unknown cellular modems. They access default/weak credentials or exposed management interfaces. They change the PLC password and lock out legitimate operators. They change network configurations like the PLC IP address and disconnect it from remote monitoring and control. Water supply equipment stops or malfunctions while facilities shift to manual operation and local recovery. 4. Attacker Position and Execution Points Attacker: Connects directly to the PLC/OT management surface from the Internet. Execution Points: PLC firmware/configuration interface, cellular modem, remote access gateway. Impact Scope: Water and wastewater treatment control equipment and monitoring stations. 5. Visibility for Victims and Administrators Victims and Users Cannot connect to the PLC from the operator console, passwords fail, IP addresses change, and assets disappear. Physical operational anomalies such as p