How Utilities Can Reduce Cyber Risk Across Critical Infrastructure
Summary
Critical infrastructure attacks can exploit exposed OT, vendor access, or weak credentials. The article recommends inventorying assets, removing direct internet exposure, segmenting networks, monitoring control systems, managing vendor access, and preparing for manual,;
Key points
- The article describes attack paths through exposed OT, stolen credentials, unpatched vulnerabilities, and vendor networks, which can create operational disruption even without direct manipulation of control systems.
- In 2015, attackers disrupted power to about 225,000 Ukrainian customers after using spearphishing, BlackEnergy, stolen credentials, and remote-administration tools.
- In July 2026, activity targeted remote monitoring and control technology at more than 30 Minnesota community water systems. Some systems were disrupted; officials reported no confirmed drinking-water quality impact, and no actor had been publicly identified.
- Bitsight reported finding 10 zero-day vulnerabilities across six automatic tank gauge systems in 2024, and thousands of internet-reachable devices. It later observed U.S. internet-exposed ATGs fall by more than 55% from March to June 2026, while some vulnerable devices remained exposed.
- The article recommends inventorying internet-facing IT and OT, removing direct internet exposure from control devices, and placing necessary remote access behind controlled gateways with strong authentication and logging.
- It also advises segmenting networks, monitoring control-process changes, reviewing vendor access, and testing restoration and manual operations.
Article Details
- Defense Focus
- Reduce the risk of operational disruption to critical infrastructure by identifying exposed IT/OT assets and vendor dependencies, controlling remote access, segmenting networks, monitoring industrial processes, and preparing for recovery and manual operations.
- Detection Methods
- Inventory internet-facing IT and OT assets, including vendor-operated assets, and identify exposed PLCs, ATGs, HMIs, engineering workstations, modems, gateways, routers, identity systems, and cloud consoles.
- Alert on changes to PLC logic and project files, new engineering sessions, altered DNS or DHCP settings, disabled alarms, unexpected OT protocol traffic, and differences between digital displays and physical readings.
- Review vendor access by account, connection source, and destination; remove dormant access and test whether a compromised supplier could reach multiple sites.
- Assess internet exposure and known vulnerabilities in operational technology, accounting for the risk that routine scanning can disrupt fragile devices.
- Data Sources
- Asset inventory and internet-exposure observations
- PLC logic and project-file change records
- Engineering-session records
- DNS and DHCP configuration changes
- Alarm status
- OT protocol traffic
- Digital process readings and corresponding physical readings
- Vendor remote-access accounts, connection sources, destinations, and session logs
- Incident notifications and vulnerability disclosures from vendors
- Platforms
- Operational technology (OT) and industrial control systems (ICS)
- Programmable Logic Controllers (PLCs)
- Automatic Tank Gauges (ATGs)
- Defensive Actions
- Remove direct internet exposure for PLCs, ATGs, and management interfaces; place necessary remote access behind controlled gateways or jump hosts.
- Require phishing-resistant MFA, least privilege, time-bounded access, and session logging for remote access.
- Segment enterprise IT, vendor access, engineering workstations, and control networks so compromise of an IT asset does not directly reach physical processes.
- Maintain and test offline known-good logic and configurations, restoration procedures, communications, and manual operating procedures.
- Include vendor-operated assets and third-party access in asset inventories and supply-chain risk management; require rapid incident notification.
- Plan for safe operation when automation or enterprise IT is unavailable, including how long physical processes can remain safe.
MITRE ATT&CK
T0855The article describes Industroyer sending commands to switches and circuit breakers, and Sandworm using MicroSCADA to send unauthorized substation commands.T0886In 2023, CyberAv3ngers compromised internet-connected Unitronics PLCs using exposed devices and default passwords.T1078 · Valid AccountsThe 2015 Ukraine power-grid attackers used stolen credentials to access systems.
Threat Actors
CyberAv3ngersThe article identifies CyberAv3ngers as an Iran-linked APT that compromised internet-connected Unitronics PLCs used by U.S. water utilities in 2023; it says responsibility for the 2026 Minnesota activity was suspected by some but not confirmed.GRU Unit 74455The U.S. Department of Justice attributed the 2015 Ukraine power-grid campaign to officers in this unit.SandwormThe article says Sandworm used the target's MicroSCADA software to send unauthorized commands to substations in 2022, then deployed CaddyWiper against the IT environment.
Malware
BlackEnergymoving from an IT foothold to a physical disruption. In December 2015, attackers used spearphishing, BlackEnergy malware, stolen credentials, and legitimate remote-administration tools before opening breakers andCaddyWiperused the target’s own MicroSCADA software to send unauthorized commands to substations, then deployed CaddyWiper against the IT environment.IndustroyerThe 2016 Industroyer attack was like the sophisticated evil stepbrother of the 2015 attack. The malware used in the attack could speak industrial protocols used in electric substations and send commands to switches andIndustroyer2to switches and circuit breakers. In 2022, Ukrainian defenders stopped an attempted attack involving Industroyer2. Later that year, Sandworm used the target’s own MicroSCADA software to send unauthorized commands to
Vendors
Products
MicroSCADAstopped an attempted attack involving Industroyer2. Later that year, Sandworm used the target’s own MicroSCADA software to send unauthorized commands to substations, then deployed CaddyWiper against the ITUnitronicsIn 2023, the Iran-linked CyberAv3ngers APT compromised internet-connected Unitronics PLCs used by U.S. water utilities, including the Municipal Water Authority of Aliquippa in Pennsylvania. The campaign relied on
Countries
IranIn 2023, the Iran-linked CyberAv3ngers APT compromised internet-connected Unitronics PLCs used by U.S. water utilities, including the Municipal Water Authority of Aliquippa in Pennsylvania. The campaign relied onUkraineUkraine’s power grid is a stark example of a cyberattack moving from an IT foothold to a physical disruption. In December 2015, attackers used spearphishing, BlackEnergy malware, stolen credentials, and legitimateUnited StatesThe United States has had warnings, too:
Industries
Critical infrastructureBut cyberattacks on U.S. critical infrastructure systems like water, hospitals, sewage, gas, and electricity aren’t new. Attackers have been targeting adversarial countries’ critical infrastructure and key resources forWater utilities2023, the Iran-linked CyberAv3ngers APT compromised internet-connected Unitronics PLCs used by U.S. water utilities, including the Municipal Water Authority of Aliquippa in Pennsylvania. The campaign relied on exposed