The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory to critical infrastructure operators, particularly those in the Water and Wastewater Systems (WWS) sector, to immediately remove internet-exposed Programmable Logic Controllers (PLCs) and other operational technology (OT) systems. This warning follows a series of cyberattacks that impacted more than 30 community water utilities across Minnesota between July 26 and 27.
Minnesota IT Services (MNIT) confirmed the coordinated cyberattack targeted OT systems, prompting the activation of the state’s cybersecurity incident response capabilities. While MNIT continues to collaborate with federal, state, local, Tribal, and private-sector partners to investigate, four cities have publicly disclosed details: Braham, Maple Plain, Plymouth, and South St. Paul. Braham, a town of approximately 1,700 residents, experienced the most significant disruption, with its water plant entirely knocked offline after attackers disabled the computerized controls for its well and treatment systems. The attacks led to boil water notices and forced some facilities to switch to manual operations, though drinking water largely remained safe due to contingency procedures.
Federal and state officials have not yet formally attributed the Minnesota attacks to a specific actor. However, Tenable researchers assess that the operational pattern is consistent with CyberAv3ngers, an Iran-linked group formally tied to the Islamic Revolutionary Guard Corps Cyber-Electronic Command. This assessment aligns with a CISA advisory updated four days prior to the Minnesota incidents, which detailed Iranian-affiliated actors targeting PLCs across U.S. critical infrastructure.
CISA is observing a significant increase in cyber threat actors targeting PLCs in the WWS sector. These attackers are not employing highly sophisticated methods; instead, they are exploiting internet-facing devices with default or weak credentials. Once remote access is gained, they modify passwords to lock out operators and change IP addresses to disconnect PLCs, leading to a loss of monitoring and control functionality. The FBI has confirmed that utility companies in at least seven states have reported similar PLC-related incidents.
A critical vulnerability, CVE-2021-22681, in Rockwell Automation PLCs (CVSS 9.8) has been actively exploited by Iranian-affiliated threat actors since March 2026. CISA has added this flaw to its Known Exploited Vulnerabilities catalog. Rockwell Automation has confirmed that no security patch is available for this vulnerability, making network isolation and other compensating controls essential.
The CISA advisory, updated in July 2026, indicates that attacks exploiting internet-exposed PLCs have expanded beyond Rockwell Automation devices to include those from Schneider Electric and Siemens. A new development noted in the advisory is the exfiltration of PLC project files. This action suggests attackers are stealing the engineering logic and programmed behavior of industrial processes to study them offline, potentially for more targeted future attacks rather than mere disruption.
CISA emphasizes that OT assets exposed to the internet face increased risks of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage. The agency stresses that even water organizations with mature cybersecurity processes must validate their external connections, as targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans.
