Thirteen Years After Bowman Avenue: The Same Country, the Same Modem

On 28 August 2013, an Iranian contractor working for an IRGC-affiliated firm gained access to the control system of a flood-control dam about 20 miles north of New York City. He came back repeatedly for three weeks. Thirteen years later, in July 2026, more than thirty Minnesota water systems were attacked, and one of the first effective containment actions available to a city was to unplug the cellular modems. Nothing in between fixed the thing that made both possible, and two disclosures published in the last three weeks suggest the gap is widening rather than closing.

Thirteen years ago today, Hamid Firoozi reached the supervisory control and data acquisition system of the Bowman Avenue Dam in Rye Brook, New York. He did not stop at looking. Between 28 August and 18 September 2013, according to the indictment the Justice Department unsealed on 24 March 2016, he repeatedly returned, altering the dam's status and operations: water levels, water temperature, and the position of the sluice gate.

The dam is not impressive. It sits on the Blind Brook, holding back water from a stretch of residential and commercial property in a village of about 10,000 people. Its sluice gate is roughly 15 feet long and 2.5 feet high. The structure dates to the early 1900s, when it served an ice business, collapsed in 1941, and was rebuilt. Rye Brook's mayor, asked about it when the indictment landed in 2016, put it plainly: "It's ridiculous how little that dam is, how insignificant in the grand scheme of things."

He was right, and it did not matter.

Here is the detail from 2015 that I think about more than any other in this file. When the story first broke in the Wall Street Journal that December, investigators had initially believed the intrusion involved the Arthur R. Bowman Dam in central Oregon: 245 feet high, 800 feet long, holding back roughly 150,000 acre-feet of water on the other side of the country. Same name, wildly different consequence.

Read that again. For a period after the breach was discovered, the United States government did not know which of its dams had been breached.

If the defenders could not immediately identify which piece of American water infrastructure had been reached, consider how little the attacker needed to know about it, either.

The Incident: What Actually Happened

The technical account is short, and its shortness is the point.

Initial access was a cellular modem. The dam's SCADA system was connected to the internet via a cellular modem, allowing operators to monitor conditions and operate the gate without driving to the site. That is the full attack surface. No exploit chain, no implant, no lateral movement worth diagramming.

Discovery was reportedly a search engine. Firoozi is reported, in coverage sourced from people close to the investigation rather than the indictment itself, to have located the system through Google dorking: targeted search operators that surface indexed devices and interfaces that nobody intended to publish. Hold that thought, because it is the part of this incident with the longest tail.

What he obtained was operational telemetry. Water level, temperature, sluice gate status. That is the data an operator needs in order to decide whether to open the gate. Which makes it the data an attacker needs in order to decide when opening the gate would do the most damage.

What he could not do was open it. The indictment's wording matters, so here it is directly: the access "would normally have permitted Firoozi to remotely operate and manipulate the Bowman Dam's sluice gate," except that "the sluice gate had been manually disconnected for maintenance at the time."

Remediation ran a little over $30,000.

That is almost certainly the smallest figure in the Hackopedia catalog. Maersk cost as much as $300 million. Norsk Hydro carried about $70 million. Bowman Avenue had a security review and some hardware, and the only reason it carried nothing more was that the linkage between the control system and the gate was physically disconnected during the exact window when an adversary had control of the system.

The control that worked was an accidental air gap created by people who were not thinking about security at all.

Two footnotes that the coverage tends to drop, both of which matter.

The first is that the dam was a single count against one of seven defendants. The March 2016 indictment was overwhelmingly a financial-sector case: a distributed denial-of-service campaign against 46 US financial institutions, running from late 2011 to mid-2013, spanning more than 176 days, costing tens of millions in remediation. Firoozi's access to a village flood gate was the footnote in the government's own document. It became the headline because it was the first time an American had to picture a foreign government's hand on a physical control.

The second is that none of the seven were ever arrested or extradited. They were in Iran then, and they are, as far as anyone has said publicly, in Iran now. Thirteen years of advisories, and thirteen years of no accountability.

Luck Is Not a Control, and It Keeps Being the Control

I wrote about Triton that what caught the attack was a bug in the attacker's own code, and that this is a thinner margin than any process industry should accept. Bowman Avenue is the same story told four years earlier with less sophistication on both sides.

It is also not the last time. When the hydropower plant near Tczew, Poland, was first breached in May 2025, the intrusion occurred while the plant was offline, allowing the attackers to gain access without impact. They came back in August, when it was running, and at that time they got a video that the internet watched.

Three incidents, three continents, three eras of technology, and in each one, the difference between an intrusion and a consequence was whether the physical process happened to be available on the day.

That is not a security architecture. It is a coin toss that infrastructure has now won several times in a row, which is the kind of record that makes people stop counting.

Thirteen Years, One Vector

Here is the part that should make this anniversary uncomfortable rather than nostalgic.

2013. An IRGC-affiliated contractor reaches a US water control system via an internet-exposed cellular modem, discovered by scanning rather than targeted for its value. Charged in 2016 alongside six others working for ITSecTeam and Mersad, Iran-based firms, the Justice Department said, performed work on behalf of the Iranian government, including the IRGC.

November 2023. The CyberAv3ngers persona, which CISA and the FBI tie to the IRGC, compromises Unitronics Vision series PLCs and HMIs across US water and wastewater utilities, including the Municipal Water Authority of Aliquippa, Pennsylvania, on 25 November. Advisory AA23-335A, published on 1 December 2023, counts at least 34 affected devices in the water sector alone, with additional targeting in the energy, food and beverage, transportation, and healthcare sectors. The devices were reachable on TCP 20256, and either had a default password in place or no password."

April 2026. Advisory AA26-097A, issued 7 April by the FBI, NSA, EPA, DOE, and US Cyber Command, documents Iranian-affiliated actors exploiting internet-exposed programmable logic controllers across US water, wastewater, energy, and government facilities. A central enabling weakness, CVE-2021-22681, is an authentication bypass in Rockwell Logix controllers that Rockwell has said cannot be fully resolved with a software patch. The 22 July update, which added Treasury as a signatory, widened the scope to Schneider Electric Modicon and Siemens S7-1200 controllers.

July 2026. Four days after that update, on Sunday the 26th and Monday the 27th, more than thirty community water and wastewater systems across Minnesota were hit in what Minnesota IT Services described as a coordinated attack. ABC News reporting in early August put related activity across at least a dozen states; the FBI's own count in late July was seven. Braham, a population of roughly 1,700, loses its computerized operating controls; the well and treatment plant go offline, and public works crews bring them back online manually in about two hours. Plymouth disconnects cellular-connected equipment at two water towers and multiple wastewater lift stations to stop the attack.

August 2026. On the 8th, CERT Polska publishes the forensic account of the December 2025 attack on a Polish combined heat and power plant serving roughly 50,000 residents. The entry point was a FortiGate VPN at a wind farm with no multi-factor authentication. From there, the attacker tunneled into the operator's private cellular APN, found that client isolation was not enabled, and used the carrier network to reach a completely unrelated facility. Inside the plant, a WAGO PFC200 controller with a web interface and default credentials became the bridge to the OT network. By 29 December, the attacker was switching Siemens S7 controllers to STOP mode and password-protecting them, shutting down the steam turbine and the process water treatment system in winter. CERT Polska assesses this as the first observed instance of a private APN being used as the attack vector in a real-world cyberattack and notes that the misconfiguration is common in Poland and likely widespread elsewhere. Researchers link the actor to Electrum.

On attribution: no federal or state authority has attributed the Minnesota attacks to a specific actor. Credible analysts, including Tenable, have noted that the pattern is consistent with the CyberAv3ngers ecosystem, and the timing relative to the 22 July advisory update is hard to ignore. I am noting that they have said it. I am not adopting it because "consistent" is not the same as "confirmed," and this catalog is worth more if it holds that line.

The continuity claim I am making does not require attribution. It is about the vector and the sector.

In 2013, access to an American water control system was via a cellular modem that connected it to the internet. In 2026, one of the first effective containment actions available to a Minnesota city was to disconnect the cellular-connected equipment at two water towers. AA26-097A documents actors deploying Dropbear SSH on victim modems to hold persistent access over port 22.

Thirteen years. Same sector. Same modem.

The tradecraft in between improved dramatically, and it is worth acknowledging just how much better. The current campaign runs vendor engineering software, Studio 5000 Logix Designer, EcoStruxure Control Expert, and TIA Portal, on leased infrastructure, so the traffic looks like an engineer performing maintenance. It exfiltrates PLC project files. In at least one FBI-documented case, it modified Add-On Instructions to disable safety shutdown and alarm logic and altered the data presented on HMI and SCADA displays so operators would not see equipment running outside safe conditions. That is the Triton pattern, applied at commodity scale to municipal water.

But every one of those techniques is a second move. The first move has not changed since 2013, and it does not need to, because it still works.

Why It Never Got Fixed

The honest answer is that the modem was never a mistake.

The Bowman Avenue Dam does not have a control room. Neither does a lift station in a town of 1,700, nor a water tower, nor a rural pump house, nor any of the tens of thousands of small distributed assets that make up the actual physical fabric of American water. They are managed remotely because the alternative is staffing them, and nobody is going to staff them.

So the remote path goes in. Somebody, often a contractor, configured it to work years ago. And working means answering. A modem that responds to the operator responds to everyone, because responding is what a modem does.

This is why thirteen years of advisories have not closed it. The guidance has been correct all along, but it has been aimed at the wrong resource. "Do not expose PLCs to the internet" is unarguable and, at a utility with four employees and no security staff, unactionable in the form it is usually delivered. "Change default credentials" was the lesson of 2023, and it is already insufficient because the current campaign bypasses authentication rather than guessing it. "Patch" is not on the table at all when the vendor has said the flaw cannot be fully patched.

And then there is the problem of what happens when the guidance is followed.

On 30 July 2026, the FBI and EPA issued an alert to the water sector on this exact exposure. Among its recommendations for mitigating unauthorized access to OT through cellular modems, operators "should consider implementing isolated architectures, such as a private Access Point Name (APN)." This is sound advice. A private APN takes your field devices off the public internet and puts them on a carrier-operated network segment reserved for you. It is the single most common answer to the cellular modem problem, and it is what a competent integrator would propose.

Nine days later, CERT Polska published the first documented case of an attacker pivoting through one.

The reason it failed is a setting. Client isolation, which prevents devices on the same APN from talking to each other, was not enabled. Without it, an adversary who compromises any device on that APN can reach every other device on that APN, including devices belonging to a different facility, a different operator, and with no business relationship at all. A wind farm became the path to a heat plant.

The FBI and EPA alert does not say that client isolation must be explicitly enabled. Neither does the carrier, in most cases. CERT Polska's own survey found the misconfiguration common among Polish organizations and expects it to be widespread beyond Poland.

Sit with what that means for the small utility this guidance was written for. They did not ignore the advisory. They read it, budgeted for it, procured the recommended architecture, and inherited a shared network segment whose most important security property was off by default and never mentioned. The control intended to solve the cellular modem problem became the lateral movement path.

This is what thirteen years of correct but insufficient guidance produces. The advice remains right in principle, but still depends on a configuration detail that the people receiving it have no way to verify.

The lesson of Bowman Avenue was never that the operator was careless. It is that the standard architecture for remotely managed small water assets produces a discoverable control interface by default, and that thirteen years of telling small utilities to be more careful has not changed the default.

The New Threat Horizon: When Nobody Has to Know What They Found

Look at what Firoozi actually had to do in 2013. Construct a search that would surface an exposed industrial interface. Recognize, from whatever that interface showed him, that he was looking at a water control system. Work out that the parameter that mattered was a sluice gate. That was skilled, patient, manual work, and it was the expensive part of the operation. The intrusion itself was trivial.

Every one of those steps is pattern recognition against unfamiliar data. Fingerprinting an unknown interface, correlating exposed hosts against known device profiles, reading a control layout to identify which parameter produces a physical effect: these are precisely the tasks that machine assistance accelerates. An adversary who can run that loop continuously has not acquired a new capability. They have acquired throughput, and throughput has always been the only thing limiting how many of these happen per month.

In every previous entry in this catalog, I have written that paragraph as a forecast. As of yesterday, it is not one.

On 19 August 2026, the NSA, CISA, FBI, Department of Energy, and EPA issued joint advisory AA26-231A describing an active threat to Siemens S7 series controllers, covering the S7-200, 300, 400, 1200, and 1500 lines, including the F-series safety controllers. The chain they describe is this: threat actors use commercial internet scanning services, Censys and ZoomEye by name, to identify S7 devices exposed on TCP 102, then feed that targeting data into AI tools that generate working Python exploitation scripts against the open-source python-snap7 library. The scripts read and write PLC memory, configuration data, and ladder logic and are packaged to appear as legitimate OT monitoring software. The agencies note the sectors already in scope: critical manufacturing, energy, water and wastewater, chemical, food and agriculture, commercial facilities, and the defense industrial base.

The advisory's own framing is worth quoting rather than paraphrasing. Using AI to generate exploitation scripts "represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts." CISA's public line was blunter: this is not a theoretical risk; it is an active threat.

Note what is not in that chain. No zero-day. No proprietary protocol reverse-engineered over years in a state lab. Scanning, fingerprinting, and a generated script against a device that answered. The step that cost Firoozi his time in 2013 has now been automated, and five federal agencies said so the day before this piece was published.

The population is already mapped. Censys published a situational report alongside AA26-097A in April 2026 identifying 5,219 exposed Rockwell and Allen-Bradley PLC hosts, of which Verizon Business accounted for 49.1 percent and AT&T Mobility for 13.3 percent. That is not a footnote about carriers. It means that for most of these controllers, a cellular modem is the sole internet path, which is to say, the exposure Firoozi used in 2013 is not a historical curiosity. It is the majority case, at scale, today, and it is enumerable from a laptop.

Which brings us back to the two Bowman Dams.

The confusion in 2015 was on the defenders' side, and that is bad enough. But notice that the attacker's side of the question was never established either. Nothing in the public record shows that Bowman Avenue was selected. It was found. It answered, and it went on a list.

Under manual reconnaissance, that distinction was cushioned by human bandwidth. Somebody had to spend time deciding you were interesting. Under automated discovery and classification, nobody has to. The system answers, the fingerprint matches, the list grows by one, and no human ever forms an opinion about whether your village flood gate was worth the trouble.

If your defense is that you are too small and too obscure to attract attention, be clear about what you are relying on: a person's finite time. That assumption has a shelf life, and the clock started a while ago.

What We Do About It

Bowman Avenue is, along with Tczew, one of the two easiest incidents in this catalog to prevent. There was no zero-day, no supply chain to audit, no proprietary protocol to defend. Remove the interface's discoverability, and there is no incident at all.

Make the control interface undiscoverable

This is the whole ballgame for assets like this one. Network cloaking means the SCADA system, the PLC, and the remote access endpoint return nothing to an unauthorized source. No ping response, no open port, no service banner, no login page, no indexed interface for a search operator to surface. A search for Bowman Avenue in 2013 returns nothing. A sweep of cellular carrier ranges in 2026 returns nothing.

Note what that defeats. It does not defeat an exploit because there was no exploit at Bowman Avenue. It does not depend on patching CVE-2021-22681, which is fortunate, because that patch does not exist. It defeats the targeting, which is the only phase this class of attack reliably has.

This is also not a vendor opinion. The lead mitigation in AA26-097A is to remove PLCs from direct internet exposure by placing them behind a secure gateway and firewall. AA26-231A, issued this week, lists ensuring PLCs are not accessible from the internet third, behind only inventory and patching, and patching is precisely the item that does not apply to CVE-2021-22681. The federal guidance and the architectural argument have converged. What is still missing is a way for a four-person utility to execute it.

One caution, given the last three weeks. "Not on the public internet" and "not reachable" are not the same statement. The Polish CHP plant was not on the public internet. It was on a private carrier network with client isolation switched off, which turned out to be a different kind of reachable and a worse one, because nobody was looking at it. Cloaking has to be a property of the asset, enforced at the asset, not a property of the network segment somebody put it on.

Stop protecting machines with secrets

Watch the progression. In 2023, Unitronics controllers were compromised because they used default or no passwords. In 2026, the password is irrelevant because the authentication is bypassed outright and the actor arrives carrying the vendor's own engineering software. Every control in that sequence was a shared secret sitting in front of a reachable device, and each one failed a little faster than the last.

Passwordless, certificate-based authentication bound to a specific verified device leaves nothing to default, nothing to leak, and nothing to replay. It also removes the standing remote-access accounts and consumer-grade remote desktop tools that keep turning out to be the way in.

Bind access to identity, not to network position

Whoever reaches a water control network should have to prove who they are on an authorized, posture-checked device, with an explicit path to the specific systems they are cleared to access. Not an IP address on an allowlist. Not a cellular APN. Not "the modem answered." What Firoozi had was reachability to a system that responded, which, under the deployed architecture, was sufficient. It should never have been close to sufficient, and under an identity-defined architecture, it is not.

Solve it once, at the gateway, for every small site

The economic constraint is the real one. A village dam, a lift station, and a water tower cannot each run a security program, and telling them to has produced thirteen years of nothing. The answer is a control placed at the gateway in front of the asset, deployed once, centrally managed, and requiring no changes to the PLC, the HMI, the addressing, or the protocol. A state with four hundred small water systems needs something it can apply four hundred times without hiring four hundred people. That is not an implementation detail. It is a design requirement, and any control that fails to meet it will not reach the sites that need it most.

Keep the manual path, and rehearse it

Braham's crews restored water service by hand in about two hours. The Bowman Avenue sluice gate was safe because it was physically disconnected. Neither of those is a substitute for architecture, and neither deserves to be dignified as a strategy. But the ability to run the plant without the control system is a genuine control; it is one of the small utilities already possessed, and it is the only item on this list that costs nothing to maintain except the discipline to practice it.

The BlastWave Thesis

The thing I keep returning to about Bowman Avenue is how completely the industry misread it at the time. The coverage in 2016 was about the audacity: Iran, a dam, twenty miles from New York City. A frightening new frontier in cybercrime, in the prosecutor's phrase. The story was the target.

The target was never the story. Nothing establishes that anyone chose Bowman Avenue. What it had was a system that answered, and the reason we are still writing about it in 2026 is that the answering never stopped.

That is why this entry belongs alongside Triton, Colonial, and NotPetya rather than in a footnote about a small-town floodgate. Triton showed the ceiling of what a state can build when it spends years on one target. Tczew showed the floor of what a scanner and some recycled credentials can reach. Bowman Avenue shows the duration. The same exposure, in the same sector, exploited by actors tied to the same government, thirteen years apart, and the intervening decade produced better advisories rather than a different architecture.

This month made that unusually easy to demonstrate. In the three weeks before this anniversary, the FBI and EPA recommended private APNs to the water sector; CERT Polska documented the first real-world attack that pivoted through one; and five federal agencies confirmed that AI is now generating exploitation scripts for internet-exposed controllers. The advice, the failure of the advice, and the escalation, inside a single month, on the thirteenth anniversary of the incident that should have settled the question.

Rye Brook, for its part, did the one thing available to it. The village eventually replaced the sluice gate in a project reported at around a million dollars. A structure that cost $30,000 to remediate got a seven-figure rebuild, and the exposure class that made it a target is now measured in the thousands of hosts on two cellular carriers.

Somewhere in the United States tonight, there is a lift station on a cellular modem that a contractor configured in 2014, and nobody has looked at it since. It is not on anyone's asset inventory. It answers when it is asked. If it is scanned this week, it will be answered this week.

The gate at Rye Brook held because someone had already unbolted it. That is the standard we have been operating at for thirteen years.

In OT, the first control is neither detection nor response. It is refusing to answer the question.

Explore the full Hackopedia at hackopedia.blastwave.com.