[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMAsl8bjEuOJtrHJUTknMDnffx7LbqekCDhdJBSpoWbg":3},{"article":4,"iocs":52,"watch_terms":53,"solutions":54,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":34},"b3be43b6-9a53-4669-8996-0466503ebebe","CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs","cisa-urges-water-and-wastewater-systems-sector-to-protect-ot-against-activity-ta-2f554f","CISA is currently observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. CISA urges critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other operational technology (OT) from the internet as soon as possible. Threat actors targeting exposed PLCs have modified passwords to lock out operators and disconnected the PLCs by changing their IP addresses. This activity has resulted in boil water notices and sustained manual operations. These threat actors are targeting water entities of all sizes. Even water organizations with mature cybersecurity processes should validate their external connections, as this targeting activity includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. OT assets exposed to the internet have an increased risk of defacement, configuration changes, operational disruptions, and, in severe cases, physical damage. CISA recommends organizations implement the following mitigations: Disconnect the PLC from the internet. Remote access for operational purposes should go through a VPN or gateway device, not directly to the PLC. Enable password protection and change default passwords. Allowlist IPs to only allow remote access from known engineering laptops or other critical OT assets. After disconnecting PLCs from the internet, operators should ensure they have a known clean backup of the PLC image in case they are locked out by a modified password. Note: Owners, operators, and integrators of Rockwell Automation MicroLogix 1400 PLCs should see Rockwell Automation’s IMPORTANT NOTICE: Restoring Access to a MicroLogix™ 1400 Controller When the Password Is Unknown for guidance addressing this activity. To securely enable remote access to your OT systems, CISA recommends system owners, operators, and integrators see the following resources for guidance: CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology United Kingdom's National Cyber Security Center: Secure Connectivity Principles for Operational Technology For additional support, contact the Environmental Protection Agency’s Cybersecurity Technical Assistance Program for the Water Sector or your CISA Regional Office. To report a cyber incident, contact CISA’s 24\u002F7 Operations Center (contact@cisa.dhs.gov), or call 1-844-Say-CISA (1-844-729-2472). Please see Reporting a Cyber Incident for more details or contact FBI’s Internet Crime Complaint Center (IC3) or your local FBI field office. When available, please include the following information regarding the incident: Date, time, and location of the incident Type of activity Number of people affected Type of equipment used for the activity Name of the submitting company or organization, and a designated point of contact Disclaimer The information in this report is being provided “as is” for informational purposes only. CISA does not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by CISA. Acknowledgements The Environmental Protection Agency and the Federal Bureau of Investigation contributed to this Alert.","CISA has observed a surge in cyber threat actors targeting Programmable Logic Controllers (PLCs) within the Water and Wastewater Systems (WWS) sector. Attackers are modifying passwords to lock out operators and changing IP addresses to disconnect PLCs, leading to disruptions like boil water notices. CISA strongly advises critical infrastructure operators to disconnect exposed PLCs and OT from the internet, implement strong password protection, and use VPNs or gateways for remote access.","CISA warns of increased PLC targeting in water systems, urging immediate disconnection from the internet.","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F07\u002F30\u002Fcisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs",null,"2026-07-30T12:00:00+00:00","2026-07-30T22:00:23.551325+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"MicroLogix 1400","product",{"name":21,"type":22},"Rockwell Automation","vendor",{"name":24,"type":25},"PLC","technology",{"name":27,"type":25},"OT",{"name":29,"type":19},"VPN","d6f63bb8-0801-486a-be7f-171400700454",{"id":30,"icon":12,"name":32,"slug":33},"IoT\u002FOT","iot-ot",[35,40,45,47],{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":46},{"id":30,"icon":12,"name":32,"slug":33},{"category":48},{"id":49,"icon":12,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":55,"vendors":142},[56,85,113],{"slug":57,"name":58,"problem":59,"products":60},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-access","Cloudflare Access","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Faccess\u002F","Zero trust access to internal applications without a VPN.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-private-access","Zscaler Private Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-private-access","Zero trust access to private applications, replacing VPN.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"slug":86,"name":87,"problem":88,"products":89},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":108,"url":111,"description":112},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"slug":114,"name":115,"problem":116,"products":117},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":160},"exposed-plcs-in-water-systems-under-active-attack","Exposed PLCs in Water Systems Under Active Attack","Threat actors are actively targeting internet-exposed Programmable Logic Controllers (PLCs) in the Water and Wastewater Systems sector, exploiting default or weak credentials to lock out legitimate operators and manipulate device configurations. The root problem is a combination of poor network segmentation — leaving OT devices directly accessible from the internet — and inadequate access control policies such as unchanged default passwords. These attacks have real-world physical consequences, including boil water advisories that endanger public health. Critical infrastructure operators often underestimate the cyber risk to OT environments, mistakenly assuming air-gapping or obscurity provides sufficient protection. This incident underscores that OT security must be treated with the same rigor as IT security, especially as legacy industrial systems increasingly gain internet connectivity.",[148,149,150,151,152,153,154,155,156,157,158,159],"CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 6 – Access Control Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-82 Rev. 3 – Guide to OT Security","NIST AC-2 – Account Management","NIST AC-17 – Remote Access","NIST SC-7 – Boundary Protection","NIST IR-4 – Incident Handling","ICS-CERT \u002F CISA Recommended Practices for ICS Security","NERC CIP-005 – Electronic Security Perimeters","ISA\u002FIEC 62443-3-3 – System Security Requirements and Security Levels",{}]