Cyberattack on U.S. Water Utility Highlights Critical Infrastructure Vulnerabilities A recent cyberattack targeted a small water utility in Aliquippa, Pennsylvania, disrupting operations and exposing gaps in the security of U.S. critical infrastructure. The incident, which occurred in late November 2023, involved the hacking of a booster station used to regulate water pressure in the town’s system. The attack was attributed to an Iranian-linked hacking group known as Cyber Av3ngers, which claimed responsibility for compromising the facility’s industrial control system (ICS). The group exploited a default password vulnerability in Unitronics programmable logic controllers (PLCs), a widely used component in water and wastewater management systems. While no physical damage or contamination was reported, the breach forced manual operation of the affected station, underscoring the risks of inadequate cybersecurity in essential services. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory in response, warning other utilities about the threat and urging immediate action to secure vulnerable systems. The attack follows a pattern of increasing cyber threats to water facilities, including a 2021 incident in Florida where hackers attempted to poison a city’s water supply by manipulating chemical levels. This incident serves as a stark reminder of the growing sophistication of state-sponsored and criminal cyber actors targeting critical infrastructure, with potential consequences for public safety and national security.

State-Backed Hackers Target Water Utilities in U.S. and Europe, Exploiting Basic Security Flaws Since 2024, water and wastewater infrastructure across the U.S. and Europe has faced a surge in cyberattacks by nation-state actors, marking a shift from opportunistic breaches to deliberate strategic targeting. Iran, Russia, and China have exploited weak security in critical systems, using them as leverage in geopolitical conflicts rather than causing immediate mass disruption. Key Incidents and Tactics - Iran-linked CyberAv3ngers exploited default credentials on Unitronics Vision Series PLCs in U.S. water systems, with attacks confirmed by CISA in December 2024 and ongoing through 2026. The group targeted exposed industrial control ports (e.g., TCP/44818, TCP/2222) and used Dropbear SSH for remote access. - Russia-associated actors, including the Cyber Army of Russia Reborn (linked to Sandworm), caused a 30–45-minute water tank overflow in Muleshoe, Texas, in January 2024. In April 2025, they breached a dam in Bremanger, Norway, opening floodgates for four hours, and compromised five Polish water treatment plants, where they altered chemical dosing parameters. - China’s Volt Typhoon adopted a stealthier approach, embedding itself in U.S. water and wastewater IT networks for long-term access, positioning for potential future conflicts. The group leveraged living-off-the-land tools like wmic, ntdsutil.exe, and PowerShell to evade detection. Common Vulnerabilities Attackers relied on preventable security gaps, including: - Internet-exposed PLCs and HMIs. - Default or weak passwords and shared operator accounts. - Poor IT/OT network segmentation. - Unsecured remote access tools. Impact and Response With 170,000 water systems in the U.S. alone many underfunded and operating on outdated technology the sector remains highly vulnerable. Federal agencies (CISA, FBI, NSA, EPA) have issued repeated warnings, emphasizing the need for basic hardening measures: removing PLCs from public internet access, enforcing multi-factor authentication, and improving OT monitoring. Indicators of compromise (IoCs) linked to these campaigns include specific IP addresses (e.g., 135.136.1[.]133), targeted network ports (TCP/502, TCP/22), and tools like Dropbear SSH and ntds.dit. Iranian actors left defacement messages on compromised HMIs, declaring Israeli-made equipment a "legal target."