Urgent News from IWEA on Cybersecurity
| IWEA has been made aware of an Iranian-affiliated cyber attack which targeted more than 30 community water systems in Minnesota on July 26 and 27. IWEA Staff has compiled a list of recommendations from the Cybersecurity & Infrastructure Security Agency (CISA) which are outlined below. We strongly urge you to take these precautions at your facilities. |
| Disconnect PLCs from direct internet exposure. Any internet-accessible Rockwell Logix controller is exploitable via CVE-2021-22681 without authentication, and there is no vendor patch. If remote access is operationally necessary, deploy a secure gateway with multifactor authentication. This is the single highest-impact remediation action. Set physical mode switches to “Run.” This prevents remote modification of PLC logic and configurations, blocking the primary impact technique documented in CISA Advisory AA26-097A. Ingest IOCs from the updated CISA Advisory AA26-097A. Download the STIX-formatted indicators of compromise from the July 22, 2026, advisory update and deploy them in SIEM, IDS, and firewall platforms. Monitor for traffic on ports 44818, 2222, 102, 22, and 502 from overseas hosting providers. Implement IT/OT network segmentation. Isolate engineering workstations running Studio 5000 Logix Designer, EcoStruxure Control Expert, and TIA Portal from untrusted network segments. Deploy allowlisting so only authorized workstations can communicate with controllers. Audit cellular OT connections. The Plymouth attack specifically targeted cellular-connected infrastructure. Verify that all cellular-connected PLCs are behind gateway firewalls with logging. Replace consumer cellular modems with industrial cellular gateways supporting VPN tunnels and multifactor authentication. Back up all PLC logic and configurations offline. Store backups on secured physical media and test restore procedures. CyberAv3ngers’ documented TTPs include PLC project file theft and ladder logic manipulation, making offline backups the last-resort recovery mechanism. |
|