Cyberattack on 30 U.S. Cities' Drinking Water | How CyberAv3ngers Paralyzed Minnesota for 48 Hours

The Night of July 26: When Water for 30 Cities Came Under Threat

On the night of July 26, 2026, a coordinated and unprecedented cyberattack began targeting more than 30 municipal water and wastewater systems across Minnesota. This attack, which continued for 48 hours, was one of the most extensive cyber operations against American critical infrastructure in recent years.

In Braham, a city with about 1,700 residents, the water treatment plant completely shut down. Residents woke up that morning to shocking news: the computerized controls managing the wells and water treatment plant had been disabled by unknown actors.

How the Attack Began: Four Cities, Four Different Stories

Nate George, Braham's mayor, said in a statement: Minnesota's local governments are expected to defend essential systems against foreign adversaries and sophisticated criminals, often with limited staff, aging technology and inadequate resources.

Plymouth, with a population of approximately 80,000, had a different experience. Rather than losing service, the city's IT division took a preemptive step: it disconnected the cellular-connected equipment at two water towers and multiple wastewater lift stations from the network to stop the intrusion and prevent re-targeting while systems were reconfigured. Operations continued through manual procedures throughout.

South St. Paul reported that some automated utility controls were affected but that contingency procedures prevented any major impact to operations. Maple Plain declared a local state of emergency to accelerate its response.

Ensuring Water Safety: No Danger to Citizens

Minnesota IT Services confirmed the incidents shared a common profile - similar timing, access methods, and target types - and described them as a coordinated attack on operational technology at community water systems statewide.

No boil-water advisories were issued. The Minnesota Department of Health confirmed that drinking water quality was unaffected at all impacted systems. As of July 29, the investigation remained active and authorities have not publicly identified the attackers, the access method used, the specific equipment affected, or whether any data was exfiltrated.

Four Days Before: A Warning That Went Unheeded

The timing of the Minnesota attacks is not incidental. On July 22 - precisely four days before the intrusions began - CISA, along with the FBI, NSA, EPA, and the Department of Energy, published a significant update to Advisory AA26-097A titled "Iranian-Affiliated Cyber Actors Exploit PLCs Across U.S. Critical Infrastructure."

That update substantially expanded what was already a serious warning in three ways. It broadened the scope of confirmed targeting beyond Rockwell Automation devices to include Schneider Electric and Siemens PLCs - specifically the Schneider Electric BMX P34/Modicon M340 and the Siemens S7-1200.

It documented, for the first time, confirmed exfiltration of PLC project files: using legitimate vendor engineering software - Rockwell's Studio 5000 Logix Designer, Schneider's EcoStruxure Control Expert, and Siemens' TIA Portal - hosted on leased third-party infrastructure, attackers had been pulling industrial control project files out of victim environments.

And it added new detection guidance for the manipulation of Add-On Instructions, or AOIs - reusable code modules embedded in PLC programs. In one confirmed incident documented by investigators, actors inserted malicious AOIs into an otherwise normal PLC project file that disabled safety shutdown and alarm systems, while simultaneously feeding falsified data to operator displays to mask what was happening at the hardware level.

CVE-2021-22681: The Flaw That Cannot Be Fixed

At the center of the current Iranian campaign is CVE-2021-22681, a critical authentication bypass in Rockwell Automation's Logix controller family. The flaw is architectural: the cryptographic key Rockwell's Studio 5000 Logix Designer software uses to authenticate communication sessions with Logix PLCs is embedded in the software in a recoverable form.

Anyone who can extract that key - and Iranian-affiliated actors have clearly done so - can impersonate legitimate engineering software and gain direct, unauthenticated access to any internet-facing Logix controller. Once connected, the attacker has engineering-level privileges: they can download project files, upload modified logic, disable alarms, and alter what operators see on their screens.

CVE-2021-22681 was disclosed by Rockwell Automation in February 2021 and assigned a CVSS 3.x severity score of 9.8 out of 10. The flaw went unexploited in the wild for five years - not because it was obscure, but because OT environments are extraordinarily difficult to patch.

Water treatment plants, energy facilities, and wastewater systems cannot take their industrial controllers offline on a standard IT patching cycle without disrupting services that must run continuously. The result is a permanent gap: a critical, known vulnerability sitting exposed in infrastructure that cannot safely be updated to close it.

Confirmed in-the-wild exploitation began in March 2026, when CISA added CVE-2021-22681 to its Known Exploited Vulnerabilities catalog. Rockwell Automation has since confirmed what was already clear from the flaw's architecture: there is no patch available and none is forthcoming. The authentication system would have to be redesigned from the ground up - at the cost of compatibility with every PLC already deployed.

CyberAv3ngers: Four Phases and a Proliferating Playbook

No official attribution for the Minnesota attacks has been announced. But security researchers at Tenable's Research Special Operations team assessed that the operational pattern - the targeting of internet-facing PLCs at water utilities, the specific infrastructure affected, and the timing relative to the July 22 CISA advisory - is consistent with the CyberAv3ngers threat ecosystem.

CyberAv3ngers - a threat group attributed by security researchers to Iranian state actors - has been active since at least 2020. According to U.S. Treasury Department reports from February 2024, the group has operational ties to Iranian security entities and has been identified in multiple campaigns against Western critical infrastructure.

The group's evolution is a documented escalation across four phases. From 2020 to 2022, it operated largely as a propaganda persona, claiming attacks on Israeli infrastructure that were later assessed as fabricated.

Between October 2023 and January 2024, it compromised at least 75 Unitronics Vision Series PLCs across the United States, United Kingdom, Israel, and Ireland - exploiting default passwords on internet-exposed devices - in what CISA confirmed was likely four separate attack waves. The highest-profile victim was the Municipal Water Authority of Aliquippa, Pennsylvania, which was forced to switch a pumping station to manual control.

In 2024 and 2025, the group deployed IOCONTROL, a custom-built Linux malware platform designed for industrial control and IoT environments, using MQTT over TLS to blend its command-and-control traffic with legitimate network activity.

Since March 2026, the group shifted to what Tenable describes as Phase Four: active exploitation of CVE-2021-22681, connecting directly to internet-facing Rockwell PLCs using legitimate engineering software and using that access to download, modify, and re-upload controller logic across water, energy, and government sectors.

The Broader Campaign: Water Infrastructure as a Target

The Minnesota attacks did not emerge from a vacuum. Throughout spring and summer 2026, cyber tensions between the United States and Middle Eastern regional actors have escalated. Security researchers have observed a similar pattern in attacks on water infrastructure on both sides - indicating a period of escalating reciprocal cyber operations.

This pattern of reciprocity - where physical attacks on one side's infrastructure lead to cyber responses from the other - is a concerning feature of modern conflicts. The evolution from physical attacks to cyber operations allows state actors to target civilian objectives without direct military consequences.

The following day, the Handala threat group - attributed by security researchers to Iran and also known as Void Manticore - claimed it had breached California Water Service billing systems in Bakersfield, Visalia, and Chico, publishing 5 gigabytes of exfiltrated data including customer personal information.

On July 23 - three days before the Minnesota attacks began - Handala escalated its warnings further, claiming a cyberattack on Maryland's operational technology infrastructure and issuing a statement declaring that U.S. water, electricity, and transportation networks would be front-line targets of its future operations.

Why Small Water Utilities Keep Losing

The Minnesota attacks are the latest chapter in a much longer story: the chronic vulnerability of small U.S. water utilities to cyberattack - a vulnerability that is structural rather than individual.

A March 2024 EPA enforcement alert found that 70% of water systems inspected by the agency since 2023 were in violation of a provision requiring them to develop or update risk assessments and emergency response plans.

A 2024 EPA Inspector General report found critical or high-severity cybersecurity vulnerabilities in 97 of 1,000 audited drinking water systems - systems collectively serving approximately 26.6 million people. A 2024 GAO report found that EPA has struggled to identify legal authorities to effectively address water sector cyber risks.

The United States has approximately 150,000 to 170,000 water systems in total. Many are small, rural, and operating with a single IT contractor - or none at all. Tenable's researchers note that the pattern of CyberAv3ngers' success against small water utilities is not coincidental but structural.

Many of these organizations manage their operational technology environments using consumer-grade remote access tools such as TeamViewer or AnyDesk, or by directly exposing PLC management interfaces to the public internet - access methods that bypass enterprise security controls entirely.

The problem is compounded by inadequate network segmentation between IT and OT environments. When a PLC is reachable from the same network segment as an email server, the blast radius of any compromise extends far beyond the initial entry point. When that PLC also controls water pressure, chemical dosing, or sewage pump operations, the consequences of a sustained compromise can extend into the physical world.

What Every Water Utility Must Do Now

CISA's updated Advisory AA26-097A provides specific, prioritized defensive guidance for organizations operating internet-exposed PLCs, particularly those running Rockwell Automation, Schneider Electric, or Siemens equipment.

The single highest-priority action is removing PLCs from direct internet exposure. CVE-2021-22681 allows unauthenticated access to any internet-accessible Rockwell Logix controller - no credentials required, no prior foothold needed, and no patch available. Every such device is exploitable right now.

Where remote access is operationally necessary, a secure gateway with multifactor authentication is the minimum acceptable substitute for direct internet exposure.

Beyond that, CISA recommends: setting physical mode switches on PLCs to Run mode to block remote modification of controller logic; downloading the updated CISA-issued indicators of compromise and deploying them in SIEM, IDS, and firewall platforms; implementing network segmentation to isolate engineering workstations; auditing all cellular OT connections and replacing consumer cellular modems with industrial cellular gateways that support VPN tunnels and multifactor authentication.

Minnesota's Lessons: What Must Change?

The Minnesota attacks demonstrate that the cybersecurity problem of American water infrastructure has moved beyond a technical issue to become a structural crisis. Temporary solutions are no longer sufficient - we need a complete overhaul in how these critical systems are protected, monitored, and managed.

Nate George, Braham's mayor, articulated this reality well: Minnesota's local governments are expected to defend essential systems against foreign adversaries and sophisticated criminals, often with limited staff, aging technology and inadequate resources. This is a nationwide problem that requires a nationwide solution.

Three Essential Structural Changes

First, dedicated federal funding for small water utility cybersecurity. EPA and CISA must create grant programs specifically targeting rural and small water utilities for OT security upgrades, secure gateway deployment, and cybersecurity professional hiring. Without financial resources, most of these systems cannot make necessary investments.

Second, mandatory requirements for network segmentation and removal of internet-connected PLCs. EPA must use its enforcement power to mandate compliance. Every water system with a publicly-accessible PLC must have an enforceable remediation timeline. This is no longer an optional recommendation - this is a national vulnerability.

Third, a national standard for critical infrastructure cyber incident disclosure. Minnesota was an exception because MNIT acted quickly and transparently. Many similar incidents are never publicly reported, meaning the broader security community cannot learn from them. A federal mandate for timely incident reporting to CISA can help prevent future attacks.

The Role of Vendors: An Ignored Responsibility

Rockwell Automation, Schneider Electric, and Siemens have a significant role in this crisis. CVE-2021-22681 is a product design flaw - not a software bug that can be patched. This was an architectural choice that sacrificed security for convenience.

These vendors must take greater responsibility for helping customers remediate these vulnerabilities. This includes offering secure gateways at reduced prices, providing free migration services for transitioning from insecure architectures, and developing next-generation controllers with security by design.

The ICS industry consortium should develop minimum security standards for all new OT equipment. If a PLC cannot implement proper authentication, it should not be certified for deployment in critical infrastructure.

The Long-Term Threat: Beyond Minnesota

Minnesota is a warning, not an anomaly. The techniques used in these attacks are proliferating to affiliated hacktivist groups. CyberAv3ngers has developed a playbook that includes CVE-2021-22681 exploitation, AOI manipulation, and use of cellular equipment as entry vectors.

This playbook is now in the hands of dozens of groups that may lack the operational discipline of the core CyberAv3ngers unit. The risk of an incident that inadvertently impacts water quality or service continuity increases with each new group that adopts these techniques.

Moreover, geopolitical tensions between the United States and Iran remain unresolved. Iranian cyber operations against American water infrastructure have escalated since the April ceasefire, not declined. The logic of reciprocity driving these attacks - U.S. strikes on Iranian water reservoirs leading to Iranian cyber attacks on American water systems - is persistent.

The Future of Water Security: A Path Forward

The long-term solution requires a multi-layered approach. At the technical level, every water system must: remove PLCs from direct internet exposure; implement secure gateways with MFA for remote access; enforce network segmentation between IT and OT; enable continuous monitoring for anomalous activity; and maintain offline backups of PLC logic and configurations.

Technical Defense-in-Depth Strategy

Network segmentation is not optional - it is the foundational layer of any defensible OT architecture. Water utilities must implement multiple security zones: a demilitarized zone (DMZ) for internet-facing services, an IT corporate zone for business systems, and an isolated OT zone for industrial control systems. Traffic between zones must pass through inspecting firewalls with strict whitelist rules. No PLC should ever be reachable from the corporate network without passing through a secured gateway that logs and authenticates every connection.

Multi-factor authentication is essential for any remote access pathway. The Plymouth incident demonstrated how cellular modems with weak authentication become the entire attack surface. Industrial cellular gateways with VPN tunnels, certificate-based authentication, and geofencing capabilities should replace consumer-grade cellular modems. If an operator needs remote access to troubleshoot a field device, they should authenticate through multiple factors - something they know, something they have, and ideally something they are.

Continuous monitoring with behavioral baselines can detect anomalous activity before it escalates. Water utilities should deploy network monitoring tools that understand industrial protocols like EtherNet/IP, Modbus, and CIP. These tools should establish normal communication patterns - which devices talk to which other devices, at what frequency, with what command types - and alert on deviations. An engineering workstation that suddenly connects to a field PLC at 2 AM when no maintenance is scheduled should trigger an immediate investigation.

Offline backups of PLC logic and configuration files are the last line of defense. If an attacker does gain access and modify controller logic, operators need a known-good baseline to restore from. These backups must be stored offline - not on a network share that the same attacker could reach - and tested regularly to ensure they can be restored quickly during an incident. The backup should include not just the ladder logic but also the device configuration, network settings, and any Add-On Instructions or custom function blocks.

At the organizational level, water utilities need: cybersecurity training programs for staff; incident response plans with tested emergency procedures; regular security audits by third-party assessors; and collaboration with neighbors for threat intelligence sharing.

Organizational Readiness and Human Factors

Technology alone cannot secure water infrastructure - the human element is equally critical. Every employee at a water utility, from the plant operator to the administrative assistant, needs basic cybersecurity awareness training. Phishing simulations tailored to the water sector can help staff recognize social engineering attempts targeting operational technology credentials. One compromised email account with access to the engineering workstation can become the entry point for a sophisticated attack.

Incident response plans must move beyond generic IT disaster recovery templates. Water utilities need OT-specific response playbooks that address scenarios like unauthorized PLC logic modification, loss of SCADA visibility, or ransomware affecting control systems. These plans should specify: who has authority to disconnect systems from the network, how to transition to manual operations safely, what communication protocols to follow with state and federal agencies, and under what conditions to notify the public. Tabletop exercises that walk through realistic attack scenarios help identify gaps before a real incident occurs.

Third-party security assessments bring an external perspective that internal teams may lack. A qualified ICS security assessor can identify vulnerabilities that operators accustomed to their environment might overlook - the default password still active on a backup PLC, the undocumented VPN connection a contractor installed years ago, or the network tap that provides visibility but also creates an unmonitored access point. These assessments should happen annually at minimum, with more frequent reviews after significant system changes.

Information sharing with neighboring utilities and through sector ISACs (Information Sharing and Analysis Centers) multiplies defensive effectiveness. When one utility detects a reconnaissance scan against their PLCs, sharing those indicators with neighbors allows the broader community to defend preemptively. The Minnesota attacks affected 30+ systems because attackers could execute a coordinated campaign across multiple independent targets. A coordinated defense that shares real-time threat intelligence can level that asymmetry.

At the policy level, we need: federal legislation for water infrastructure cybersecurity; dedicated funding for security upgrades; better cooperation between EPA, CISA and state agencies; and international diplomacy to establish norms against cyber attacks on civilian critical infrastructure.

Final Message: This Is a National Security Issue

The Minnesota attacks demonstrated that water system cybersecurity is no longer a local IT problem - it is a national security issue. When nation-state actors can coordinately attack 30+ water systems in one state, we face a systematic vulnerability that requires a systematic response.

Clean drinking water is a fundamental right, not a privilege. Protecting the systems that provide that water must be a national priority. Minnesota showed us what happens when that protection fails. The question is: Will we listen?

The silence in Braham on the morning of July 27 - when the water treatment plant shut down and 1,700 people were cut off from their water - was a glimpse of a future where cyberattacks disable not just data but essential services. This is a future we must prevent.

The cost of inaction is clearly on display: more vulnerability, more attacks, and eventually, a catastrophic incident that impacts not just control systems but the water itself. We still have time to prevent that future - but the window is closing.

Minnesota was a test case. The next one might be much worse. Will we be ready?