Strengthening Cybersecurity After More Than 12 State Breaches

More than a dozen U.S. states have reported cybersecurity attacks targeting their water and wastewater systems since July. While federal investigators have not officially named any culprits, they highly suspect the attacks could be coming from Iran.

The hacking strategies facing water systems this year closely resemble a series of similar attacks in 2023 carried out by the “CyberAv3ngers,” a group linked to the Iranian Revolutionary Guard. These attacks targeted U.S.-based programmable logic controllers (PLCs) and human-machine interfaces (HMIs). Hackers used custom ladder logic code to break into more than 75 devices, replacing the valid ladder logic with malicious code that investigators have continued to see this year. They also renamed devices, reset software to older versions and changed default port numbers, all in an effort to keep operators out, according to the Cybersecurity and Infrastructure Security Agency (CISA).

Attacks this year have not impacted drinking water; they have revealed holes in protection for these critical water systems. Since July, more than a dozen states have faced cybersecurity hacks, including:

1. Michigan: In early August, nine wastewater systems in Michigan were attacked. Authorities have not released which cities were impacted, according to Click On Detroit.
2. South Dakota: South Dakota had two cyberattacks in the month of July. On July 5, cyberattacks disrupted Pennington County government networks, then later in the month, an attack attempt was made against the municipal lift station in Rapid City’s wastewater system. Luckily, Rapid City’s infrastructure was not put in danger by the breach.
3. Minnesota: Between July 26 and 27, more than 30 community water systems were impacted across Minnesota, including South St. Paul, Plymouth, Maple Plain and Braham. Luckily, water safety was not affected. The CyberAv3ngers took responsibility for these attacks, saying they were to “warn America to back down,” though the U.S. government has not substantiated these claims yet, according to the Center for Strategic and International Studies.
4. Georgia: On July 27, the Clayton County Water Authority had cyber activity that caused a pump station to fail and water pressure to drop, forcing the county to issue a boil water advisory and causing some customers to have little to no water pressure. Luckily, service to its 300,000 customers was restored within a few hours.
5. New Jersey: In early August, two water systems in New Jersey were targeted in Cape May and Woodbine. The systems were temporarily blinded when automated systems went down. Both utilities shifted to manual operations and the state said there was no service disruption.

In April, the U.S. Environmental Protection Agency (EPA), the Federal Bureau of Investigation (FBI), CISA and the National Security Agency (NSA) issued a joint advisory to U.S. organizations warning of the threat of attack and offering some mitigation tactics, including removing PLCs from direct internet exposure via secure gateway and firewall, querying available logs for provided indicators of compromise (IOCs) and checking available logs for suspicious traffic on the ports tied to operational technology (OT) devices, including 44818, 2222, 102 and 502, especially traffic coming from overseas hosting providers.

“The FBI and its partners are issuing this advisory to ensure organizations are best positioned to defend themselves against exploitation by Iran-affiliated cyber actors,” said Assistant Director Brett Leatherman of the FBI’s cyber division in a statement. “Our goal is to prevent further operational disruption and financial loss for targets of this threat activity while we work to impose costs on malicious actors—all of which builds upon the new cyber strategy for America.”

Rockwell Automation released an advisory to customers that, if operators are locked out of devices, they can regain control by turning off the power and removing and reinstalling the batteries. This will erase the IP address and program. The company also advised systems to create offline backups and remove internet-connected devices from the public network.

CISA also released an advisory for operators using Siemens S7 Series PLCs warning that threat actors are targeting devices running outdated software or that are otherwise poorly protected. The agency urged owners and operators to ensure their PLC devices are “properly protected with all applicable security patches and updates, are isolated from the internet wherever possible, have strong access controls and employ security tooling to monitor ICS environments for anomalous or malicious activity.”