[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fetNYJCeRzKOAwrpFdHxDA-tBLDNE5PtgGmcZBxa8L_g":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"9b44010a-33aa-435f-b872-f54b5e0f46a3","CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks","cisa-over-100-internet-exposed-water-systems-targeted-in-july-cyberattacks-af99c4","The agency has released guidance on reducing internet exposure in the wake of the recent Iran-linked hacker attacks. The post CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks appeared first on SecurityWeek.","CISA has revealed that over 100 internet-exposed water and wastewater systems were targeted in cyberattacks during July. The attacks, linked to Iranian threat actors, primarily exploited programmable logic controllers (PLCs) connected via cellular modems to disrupt operational technology. While no significant disruptions were reported, CISA has issued guidance urging organizations to reduce internet exposure of critical infrastructure systems.","CISA reports over 100 internet-exposed water systems targeted by Iran-linked hackers in July.","https:\u002F\u002Fwww.securityweek.com\u002Fcisa-over-100-internet-exposed-water-systems-targeted-in-july-cyberattacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F10\u002FWater-Utility-Cyberattack.jpg","2026-08-26T11:29:50+00:00","2026-08-26T12:00:23.821132+00:00",8,[17,20,23,25,27,30],{"name":18,"type":19},"Iran-linked hackers","threat_actor",{"name":21,"type":22},"Siemens","vendor",{"name":24,"type":22},"Schneider Electric",{"name":26,"type":22},"Rockwell Automation",{"name":28,"type":29},"programmable logic controllers","technology",{"name":31,"type":29},"operational technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":58,"vendors":145},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"outpost24","Outpost24","\u002Fvendor-logos\u002Foutpost24.png","outpost24-easm","Outpost24 EASM","https:\u002F\u002Foutpost24.com\u002Fproducts\u002Fexternal-attack-surface-management\u002F","Discovery and risk assessment of internet-facing assets.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":89,"name":90,"problem":91,"products":92},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[93,100,108],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":95,"url":98,"description":99},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"slug":117,"name":118,"problem":119,"products":120},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":159},"internet-exposed-water-systems-targeted-by-iranian-threat-actors-via-unsecured-plcs","Internet-Exposed Water Systems Targeted by Iranian Threat Actors via Unsecured PLCs","Over 100 water and wastewater systems were targeted because their operational technology (OT) — specifically programmable logic controllers (PLCs) — was directly accessible from the internet via cellular modems, creating an easily exploitable attack surface. This reflects a fundamental configuration failure: critical industrial control systems should never be reachable from public networks without strict access controls and segmentation. The fact that Iranian state-linked actors were able to identify and target these systems at scale suggests they are being actively enumerated through tools like Shodan. While disruptions were limited this time, successful manipulation of water treatment systems could have serious public health consequences. This incident underscores the urgent need for OT\u002FICS environments to adopt network isolation principles standard in IT security.",[151,152,153,154,155,156,157,158],"CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-82: Guide to ICS Security","NIST CSF PR.AC-5: Network integrity is protected","NIST CSF PR.PT-4: Communications and control networks are protected","ICS-CERT \u002F CISA Advisory AA24-207A","NERC CIP-005: Electronic Security Perimeters","ISA\u002FIEC 62443-3-3: System Security Requirements and Security Levels",{}]