State-Backed Hackers Target Water Utilities in U.S. and Europe, Exploiting Basic Security Flaws Since 2024, water and wastewater infrastructure across the U.S. and Europe has faced a surge in cyberattacks by nation-state actors, marking a shift from opportunistic breaches to deliberate strategic targeting. Iran, Russia, and China have exploited weak security in critical systems, using them as leverage in geopolitical conflicts rather than causing immediate mass disruption. Key Incidents and Tactics - Iran-linked CyberAv3ngers exploited default credentials on Unitronics Vision Series PLCs in U.S. water systems, with attacks confirmed by CISA in December 2024 and ongoing through 2026. The group targeted exposed industrial control ports (e.g., TCP/44818, TCP/2222) and used Dropbear SSH for remote access. - Russia-associated actors, including the Cyber Army of Russia Reborn (linked to Sandworm), caused a 30–45-minute water tank overflow in Muleshoe, Texas, in January 2024. In April 2025, they breached a dam in Bremanger, Norway, opening floodgates for four hours, and compromised five Polish water treatment plants, where they altered chemical dosing parameters. - China’s Volt Typhoon adopted a stealthier approach, embedding itself in U.S. water and wastewater IT networks for long-term access, positioning for potential future conflicts. The group leveraged living-off-the-land tools like wmic, ntdsutil.exe, and PowerShell to evade detection. Common Vulnerabilities Attackers relied on preventable security gaps, including: - Internet-exposed PLCs and HMIs. - Default or weak passwords and shared operator accounts. - Poor IT/OT network segmentation. - Unsecured remote access tools. Impact and Response With 170,000 water systems in the U.S. alone many underfunded and operating on outdated technology the sector remains highly vulnerable. Federal agencies (CISA, FBI, NSA, EPA) have issued repeated warnings, emphasizing the need for basic hardening measures: removing PLCs from public internet access, enforcing multi-factor authentication, and improving OT monitoring. Indicators of compromise (IoCs) linked to these campaigns include specific IP addresses (e.g., 135.136.1[.]133), targeted network ports (TCP/502, TCP/22), and tools like Dropbear SSH and ntds.dit. Iranian actors left defacement messages on compromised HMIs, declaring Israeli-made equipment a "legal target."