Report Details State-Linked Cyber Threats to Water Systems
Summary
A threat-intelligence report reviews Iranian, Russian, and Chinese activity targeting water infrastructure from 2024–2026, describing incidents, access methods, strategic aims, recurring security weaknesses, and indicators for defenders.
Key points
- Iran-linked actors have targeted exposed PLCs and HMIs, often using weak authentication; reported activity includes device compromise, defacement, and access to control systems.
- Russian-linked actors have manipulated water infrastructure, including causing a Texas water tank to overflow and opening a floodgate in Norway; Polish plant breaches were reported but not attributed.
- U.S. agencies assessed Volt Typhoon’s access to water and other critical infrastructure as pre-positioning for potential disruption during a future crisis.
- Common weaknesses include internet-facing control interfaces, weak or default credentials, shared accounts, legacy systems, limited monitoring, and poor IT/OT segmentation.
- Several criminal or unattributed incidents disrupted business systems or required utilities to switch to manual operations, while reported water supplies remained safe.
- The report assesses near-term risk as low-complexity OT compromise and localized disruption, with longer-term concern about persistent access for use in a geopolitical crisis.
- Appendices provide indicators, ports, tools, artifacts, and ATT&CK mappings, including behavioral details for Iranian-affiliated actors and Volt Typhoon.
Article Details
- Publisher
- DomainTools
- Report Period
- 2024–2026
- Scope
- Nation-state and state-aligned activity affecting water and wastewater systems, including incidents, exposure patterns, and detection artifacts.
- Key Statistics
- The U.S. water sector comprises roughly 170,000 water and wastewater systems, according to the report.
- The EPA alerted more than 60,000 water and wastewater systems about Volt Typhoon in 2024.
- A May 2026 Polish Intelligence Service report stated that five Polish water treatment plants were breached in 2025; attribution was not confirmed.
- The Bremanger dam floodgate reportedly released roughly 500 liters of water per second for four hours in April 2025.
- The Muleshoe, Texas water tank reportedly overflowed for roughly 30–45 minutes in January 2024.
- Recommendations
- Water systems should report incidents and harden exposed OT assets, as emphasized by the EPA.
- Address exposed HMIs and PLCs, weak or default credentials, shared accounts, limited monitoring, and poor IT/OT segmentation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 135[.]136[.]1[.]133 | Reportedly used by Iranian-affiliated actors to communicate with internet-facing Rockwell Automation / Allen-Bradley PLCs. |
| IPV4 | 185[.]82[.]73[.]162 | Reportedly used by Iranian-affiliated actors to communicate with internet-facing Rockwell Automation / Allen-Bradley PLCs. |
| IPV4 | 185[.]82[.]73[.]164 | Reportedly used by Iranian-affiliated actors to communicate with internet-facing Rockwell Automation / Allen-Bradley PLCs. |
| IPV4 | 185[.]82[.]73[.]165 | Reportedly used by Iranian-affiliated actors to communicate with internet-facing Rockwell Automation / Allen-Bradley PLCs. |
| IPV4 | 185[.]82[.]73[.]167 | Reportedly used by Iranian-affiliated actors to communicate with internet-facing Rockwell Automation / Allen-Bradley PLCs. |
| IPV4 | 185[.]82[.]73[.]168 | Reportedly used by Iranian-affiliated actors to communicate with internet-facing Rockwell Automation / Allen-Bradley PLCs. |
| IPV4 | 185[.]82[.]73[.]170 | Reportedly used by Iranian-affiliated actors to communicate with internet-facing Rockwell Automation / Allen-Bradley PLCs. |
| IPV4 | 185[.]82[.]73[.]171 | Reportedly used by Iranian-affiliated actors to communicate with internet-facing Rockwell Automation / Allen-Bradley PLCs. |
MITRE ATT&CK
T0883Internet-accessible devices were reported as an access path to exposed PLCs and ICS; the report also maps this technique to Polish incidents.T0885The report maps Iranian-affiliated activity using OT ports and SSH to this technique.T1003.003 · NTDSAttempted extraction of ntds.dit and registry hives is mapped to this technique.T1018 · Remote System DiscoveryNetwork and host reconnaissance is mapped to this technique.T1021 · Remote ServicesMovement through compromised internal environments is mapped to this technique.T1046 · Network Service DiscoveryAssessed scanning or discovery of exposed water-control interfaces is mapped to this technique; the report identifies this Russia-related mapping as lower-confidence.T1047 · Windows Management InstrumentationWMIC execution for process creation and credential-access workflows is mapped to this technique.T1059.001 · PowerShellNative PowerShell use in living-off-the-land activity is mapped to this technique.T1078 · Valid AccountsDefault or weak credential abuse is mapped to this technique; some incident mappings are assessed rather than confirmed.T1087 · Account DiscoveryAccount and environment enumeration is mapped to this technique.T1090 · ProxyUse of netsh portproxy for forwarding or covert access is mapped to this technique.T1113 · Screen CaptureScreen recordings of HMI manipulation are mapped to this technique; the report describes the mapping alongside public claims.T1133 · External Remote ServicesLikely access through remote industrial interfaces is mapped to this technique; the report identifies this Russia-related mapping as lower-confidence.T1190 · Exploit Public-Facing ApplicationThe report maps Volt Typhoon compromise of exposed edge devices and public-facing infrastructure to this technique.T1219 · Remote Access ToolsDropbear SSH deployment for remote access is mapped to this technique.T1489 · Service StopWater-system disruption is mapped to this technique in the report; the American Water mapping is explicitly conditional if disruption is confirmed.T1491 · DefacementHMI/PLC defacement messaging in Unitronics activity is mapped to this technique.T1560 · Archive Collected DataStaging and compression of collected data, including 7z examples, is mapped to this technique.T1562 · Impair DefensesAvoidance of EDR visibility through native tooling and low-noise operations is mapped to this technique.T1565 · Data ManipulationThe report maps HMI/SCADA data and process-control manipulation to this technique; some Russia and Poland mappings are analytic and lower-confidence.
Threat Actors
Black BastaClaimed responsibility for an incident affecting Southern Water; no operational impact was reported.CARRThe report uses CARR as an abbreviation for Cyber Army of Russia Reborn.Cyber Army of Russia RebornClaimed responsibility for water-system manipulation in Texas; the report says Mandiant linked the group to Sandworm.CyberAv3ngersThe report identifies this IRGC-affiliated group as targeting and compromising Unitronics PLCs and describes Iranian-affiliated PLC activity.SandwormThe report describes Sandworm as Russia’s GRU-associated destructive cyber unit and says Mandiant linked Cyber Army of Russia Reborn to it.Volt TyphoonThe report says the group compromised IT environments across U.S. critical infrastructure, including water and wastewater, for potential future disruptive or destructive effects.
Vendors
Rockwell Automation135.136.1[.]133 IP address March 2026 Used by Iranian-affiliated APT actors to communicate with Rockwell Automation / Allen-Bradley PLCsUnitronics2024, CISA reported that the IRGC-affiliated CyberAv3ngers targeted and compromised Israeli-made Unitronics Vision Series PLCs used across multiple sectors, including U.S. water and wastewater systems. The
Products
CompactLogixoverseas infrastructure to access internet-facing Rockwell Automation / Allen-Bradley PLCs, including CompactLogix and Micro850 devices, and that activity resulted in project-file extraction, HMI / SCADA dataMicro850to access internet-facing Rockwell Automation / Allen-Bradley PLCs, including CompactLogix and Micro850 devices, and that activity resulted in project-file extraction, HMI / SCADA data manipulation,Studio 5000 Logix DesignerStudio 5000 Logix DesignerUnitronics Vision Series PLCsCISA reported that the IRGC-affiliated CyberAv3ngers targeted and compromised Israeli-made Unitronics Vision Series PLCs used across multiple sectors, including U.S. water and wastewater systems. The activity
Tools
Dropbear SSHSSH access; Dropbear SSH observed on victim endpointsnetshnetsh interface portproxy Native Windows tool Port forwarding / proxying for persistence and C2ntdsutil.exentdsutil.exe Native Windows tool Active Directory database extractionPowerShellPowerShell Native Windows tool Execution, discovery, and administration abusewmicwmic / WMIC Native Windows tool Process creation, discovery, credential-access workflows
Countries
Chinafit a modern hybrid warfare doctrine that has become increasingly dominant in recent years. Russia, China, and Iran all use cyber access primarily as a shaping tool, not a destructive weapon. Water-system accessIrana modern hybrid warfare doctrine that has become increasingly dominant in recent years. Russia, China, and Iran all use cyber access primarily as a shaping tool, not a destructive weapon. Water-system accessIsrael"You have been hacked, down with Israel.NorwayA little over a year later, in April 2025, attackers seized control of a dam in Bremanger, Norway. They opened a floodgate, releasing roughly 500 liters of water per second for four hours before the incident wasPolandPoland and European Water-System ExposureRussiawater systems fit a modern hybrid warfare doctrine that has become increasingly dominant in recent years. Russia, China, and Iran all use cyber access primarily as a shaping tool, not a destructive weapon. Water-systemUnited Kingdomand online bill payment, while treatment operations remained unaffected. Southern Water in the United Kingdom was also claimed by Black Basta, with customer and employee data at risk but no reported operationalUnited States