Community Advisory: Coordinated Attack On Minnesota Water Systems

July 13, 2022

August 5, 2026

—

Blog

If you run or support operational technology, you have probably already seen the headlines out of Minnesota. I want to put the confirmed facts in one place, separate them from the speculation, and point to the small number of architectural decisions that can prevent these incidents and attacks from affecting your network.

What is confirmed

Between Sunday, July 26 and Monday, July 27, more than 30 community water and wastewater systems across Minnesota were targeted in what Minnesota IT Services has described as a coordinated cyberattack. MNIT activated statewide incident response.

Four cities have publicly disclosed impact:

Braham (pop. ~1,700): computerized operating controls were disabled, and the city's well and treatment plant went offline. Public works crews restored it manually in roughly two hours.
Plymouth (pop. ~80,000): the city disconnected cellular-connected equipment at two water towers and multiple wastewater lift stations to halt the attack and prevent retargeting during reconfiguration. Operations continued manually.
South St. Paul: Some automated water utility controls were affected.
Maple Plain: declared a local state of emergency to expand response capacity.

In every disclosed case, drinking water quality was not affected, and no boil-water advisories were issued. The Minnesota Department of Health is working directly with the affected systems.

On attribution: Federal and state officials have not attributed these attacks to a specific actor, and the investigation is ongoing. Multiple researchers have noted the pattern is consistent with the IRGC-linked CyberAv3ngers ecosystem, and that CISA updated its advisory on Iranian-affiliated PLC targeting on July 22, four days before the attacks began. Consistent with is not the same as confirmed. Treat it as context, not conclusion.

The tradecraft CISA has published

The following are documented in CISA Advisory AA26-097A (issued April 7, 2026, with FBI, NSA, EPA, DOE, USCYBERCOM, and Treasury; updated July 22, 2026). These are not specific to the Minnesota incidents, but they describe the campaign that the Minnesota activity resembles, and they are worth reading against your own architecture today.

Initial access: internet-exposed PLCs. The advisory characterizes the access method as exploitation of internet-exposed, misconfigured PLCs reached through vendor engineering software, rather than a discrete software flaw. Originally scoped to Rockwell Automation/Allen-Bradley devices, the July 22 update expanded it to include Schneider Electric (BMX P34/Modicon M340) and Siemens (S7-1200) PLCs, with observed scanning on ports associated with other OT vendor protocols suggesting broader opportunistic targeting.

Living off the vendor's own tooling. Actors have been observed using legitimate engineering software (Rockwell's Studio 5000 Logix Designer, Schneider's EcoStruxure Control Expert, Siemens' TIA Portal) hosted on leased third-party infrastructure to connect to internet-facing controllers. There is no malware signature to catch here. The traffic looks like an engineer doing their job.

Project file exfiltration. Newly documented in the July update: actors pulling PLC project files out of victim environments and transferring them to systems under their control.

Manipulation of safety and alarm logic. The FBI observed a case where a malicious project file preserved normal downstream ladder logic while inserting modified Add-On Instructions that disabled safety shutdown and alarm systems. Actors also manipulated data on HMI and SCADA displays, allowing equipment to operate in unsafe conditions without alerting operators. This is the Triton pattern applied at scale: attack the layer that tells the truth, so the operator never knows.

Persistence on cellular modems. In at least one incident, actors deployed Dropbear SSH on victim modems to maintain remote access over port 22. Censys analysis from April found a disproportionate share of exposed industrial hosts sitting on cellular carrier networks, which is precisely the vector Plymouth disconnected.

The vulnerability has no patch. CVE-2021-22681, the authentication bypass most directly associated with this campaign, was disclosed in 2021 and added to CISA's KEV catalog in March 2026 after in-the-wild exploitation was confirmed. Rockwell has stated it cannot be fully addressed with a software patch. Architectural controls are the only remediation path. If your program is built around patch cycles, this one will sit open indefinitely.

Detection starting points: inbound traffic on ports 44818 (EtherNet/IP), 2222, 102 (S7comm), 502 (Modbus), and 22 on OT-connected modems, particularly from foreign-hosted ranges. Unregistered workstations connecting to PLC management interfaces. Project file or AOI modifications outside documented maintenance windows. CISA has published a STIX indicator bundle covering September 2025 through July 2026.

What actually prevents this

Every incident in this campaign shares one precondition: the controller was reachable. Not vulnerable, not unpatched. Reachable. That is the whole game, and it is why three architectural principles keep showing up in the after-action reports.

1. If it cannot be discovered, it cannot be targeted. The scanning that precedes these attacks is indiscriminate. Adversaries sweep the internet for devices that answer on industrial ports, then come back for the ones that respond. An asset that does not answer unauthenticated scans is not on the target list. Removing OT assets from public reachability, whether through cloaking, deny-by-default gateways, or genuine air gaps, eliminates the reconnaissance phase entirely. CISA's first recommendation is to disconnect PLCs from direct internet exposure, and it calls this the single highest-impact action available.

2. Credentials are the wrong control for machines. The 2023 Unitronics campaign compromised at least 75 PLCs largely through factory-default passwords. The current campaign does not require passwords at all because CVE-2021-22681 bypasses authentication entirely. Any control that can be guessed, phished, leaked, or bypassed will eventually be. Passwordless, cryptographically verified identity for every device and every operator, with no shared secret to steal, removes an entire category of failure. It also removes the standing remote-access accounts and consumer-grade tools (TeamViewer, AnyDesk, unmanaged VPNs) that so often turn out to be the way in.

3. Segmentation determines blast radius. The reason more than 30 systems were affected in 48 hours is that flat networks let a repeatable technique scale. When a PLC is reachable from the same segment as email and workstations, or when a single compromised cellular gateway provides a path to the plant, the blast radius is the entire environment. Microsegmentation down to the individual asset means a successful compromise buys the adversary one device, not one utility, or thirty.

None of this is new guidance. IEC 62443 has said it for years. What is new is the pace of exploitation and the fact that the vulnerability at its center has no patch, which moves the architecture from best practice to the only available answer.

If you operate water, wastewater, or any PLC-driven process

A short list for this week:

Inventory every controller with a path to the public internet, including through cellular modems and vendor remote-access arrangements. Assume your inventory is incomplete until you scan for it.
Set physical mode switches to RUN where operations allow. This blocks remote logic modification.
Ingest the AA26-097A indicators into your SIEM, IDS, and firewalls, and check historical logs against them.
Audit cellular OT connections specifically. Replace consumer modems with industrial gateways that support VPN tunneling and multifactor authentication.
Back up all PLC logic and configurations offline, on secured physical media, and test the restore.
Confirm your operators can run the plant manually. Braham's two-hour recovery was a manual recovery. That capability is a security control.

Primary sources

If it is useful to your team, we maintain Hackopedia, a free, open reference of major OT and industrial cyber incidents.

Please forward this to anyone responsible for a plant floor, a lift station, or a control room. The utilities most at risk here are the small ones without a security team, and they are the least likely to be on anyone's distribution list.

Stay safe out there.

Tom Sego Co-founder & CEO, BlastWave

Frequently Asked Questions

What happened to Minnesota’s water and wastewater systems?

More than 30 community water and wastewater systems across Minnesota were targeted in a coordinated cyberattack between July 26 and July 27, 2026. Several communities reported disrupted automated controls, but drinking water quality was not affected.

Which Minnesota communities reported operational impacts?

Braham, Plymouth, South St. Paul, and Maple Plain publicly reported impacts. Braham temporarily lost computerized control of its well and treatment plant, while Plymouth disconnected cellular-connected equipment and continued operations manually.

Who was responsible for the Minnesota water utility cyberattacks?

Federal and state authorities have not publicly attributed the attacks to a specific threat actor. Researchers noted similarities to activity associated with the IRGC-linked CyberAv3ngers ecosystem, but that connection remains unconfirmed.

How do attackers gain access to internet-connected PLCs?

Attackers scan the internet for exposed industrial devices and connect to misconfigured PLCs using legitimate vendor engineering software. In some cases, they can bypass authentication, download project files, modify logic, or maintain persistence through cellular modems.

Why can’t these PLC vulnerabilities simply be patched?

Some industrial vulnerabilities cannot be fully corrected through software updates. CVE-2021-22681, which has been associated with this campaign, cannot be completely remediated with a software patch, making architectural protections essential.

How does network cloaking protect water utilities?

Network cloaking prevents unauthorized users and scanners from discovering PLCs, HMIs, SCADA systems, and other OT assets. When industrial devices do not respond to unauthenticated scans, attackers cannot identify or directly target them.

Why is passwordless access important for OT security?

Passwordless access removes shared or reusable credentials that can be stolen, guessed, phished, or bypassed. Cryptographically verified identity ensures that only approved users and devices can connect to critical OT systems.

How does microsegmentation reduce the impact of an OT cyberattack?

Microsegmentation isolates individual devices and systems so a compromised controller, modem, or workstation cannot provide access to the rest of the OT environment. This limits lateral movement and reduces the potential blast radius.

What should water utilities monitor for?

Utilities should monitor inbound connections on industrial ports such as 44818, 2222, 102, 502, and port 22 on OT-connected modems. They should also investigate unregistered engineering workstations, unexpected PLC project-file transfers, and logic changes outside approved maintenance windows.

Why is manual operation an important cybersecurity control?

Manual operation allows a utility to continue providing essential services when automated systems are disconnected or compromised. Braham’s recovery demonstrated that trained operators and tested manual procedures can significantly improve operational resilience.

How to Protect PLC-Driven Water and Wastewater Systems

1. Identify every internet-reachable OT asset

Inventory PLCs, HMIs, SCADA systems, engineering workstations, cellular modems, and vendor remote-access connections. Confirm the inventory through active internal assessment because undocumented connections may exist.

2. Remove PLCs from direct public exposure

Disconnect controllers from the public internet and place them behind a deny-by-default gateway, secure overlay, virtual air gap, or network-cloaking architecture. Industrial services should remain invisible until an authorized user or device has been verified.

3. Audit cellular-connected equipment

Review every cellular modem and gateway connected to water towers, treatment plants, lift stations, and remote facilities. Monitor port 22 and replace consumer-grade modems with industrial gateways that support encrypted tunnels and strong authentication.

4. Eliminate password-based OT access

Replace shared passwords, standing remote-access accounts, unmanaged VPNs, and consumer remote-desktop tools with passwordless, cryptographically verified authentication tied to approved users and devices.

5. Microsegment critical assets

Create individual security boundaries around PLCs, safety systems, HMIs, engineering workstations, and remote facilities. Permit only the specific communications required for operations and deny all other connections by default.

6. Restrict remote logic changes

Set physical controller mode switches to RUN where operationally appropriate. Require documented authorization and approved maintenance windows before allowing PLC logic, Add-On Instruction, firmware, or configuration changes.

7. Monitor industrial protocols and engineering activity

Alert on unexpected traffic using EtherNet/IP, S7comm, Modbus, SSH, and other OT protocols. Investigate connections from foreign-hosted infrastructure, unregistered engineering stations, and project-file transfers outside normal operations.

8. Apply CISA indicators

Ingest the indicators from CISA Advisory AA26-097A into firewalls, intrusion-detection systems, SIEM platforms, and historical log searches. Review past activity for evidence of scanning, unauthorized controller access, or configuration changes.

9. Back up PLC logic offline

Maintain secured offline copies of PLC programs, Add-On Instructions, HMI configurations, modem settings, and engineering files. Regularly test restoration procedures rather than assuming backups will work during an incident.

10. Test manual operations and incident response

Confirm that operators can safely run essential processes manually when automated controls are unavailable. Conduct exercises covering controller isolation, cellular disconnection, manual treatment operations, system restoration, and communication with state and federal agencies.