aviatrix logoAviatrix
Under Active Attack

Executive Summary

In August 2026, Iran-linked threat actors conducted a sophisticated campaign targeting critical water and wastewater systems across at least 12 US states, utilizing advanced persistent threat techniques to infiltrate industrial control systems. The attackers successfully compromised SCADA networks and human-machine interfaces, demonstrating their ability to manipulate critical infrastructure operations. In a parallel attack, the same threat group shut down a UK power plant for four days in July 2026, highlighting the global reach and severity of their capabilities. The incidents caused significant operational disruptions, water service outages affecting hundreds of thousands of residents, and forced emergency response protocols across multiple states.

These attacks represent a dangerous escalation in nation-state targeting of critical infrastructure, coinciding with increased geopolitical tensions and sophisticated adversaries developing specialized capabilities for industrial control system compromise. The incidents underscore the urgent need for enhanced OT security measures and zero-trust architectures protecting critical national infrastructure.

Why This Matters Now

Nation-state actors are actively targeting critical infrastructure with proven capabilities to cause physical damage and service disruptions, requiring immediate implementation of advanced OT security controls and segmentation to prevent catastrophic attacks on essential services.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The attackers exploited vulnerabilities in internet-connected industrial control systems and SCADA networks, likely using spear-phishing and credential theft to gain initial access before moving laterally to critical operational technology systems.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely have constrained this nation-state attack against critical infrastructure by segmenting network access and reducing lateral movement capabilities. The attackers' ability to spread across water systems and power infrastructure would have been significantly limited through identity-aware segmentation and controlled east-west traffic flows.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Cloud-native security fabric would likely have reduced the attack surface by providing unified visibility and policy enforcement across critical infrastructure network segments, potentially limiting the scope of initial compromise across multiple state systems.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-based zero trust segmentation would likely have constrained privilege escalation by requiring continuous authentication and authorization, limiting the attackers' ability to gain elevated access across infrastructure systems without proper credentials.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely have prevented lateral movement between critical infrastructure segments, constraining the attackers' ability to spread from water treatment systems to power grid infrastructure through controlled inter-workload communications.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Unified visibility and control mechanisms would likely have detected and constrained command and control communications by monitoring traffic patterns across infrastructure environments, reducing the attackers' ability to maintain persistent access channels.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policies would likely have constrained data exfiltration by restricting outbound data flows and monitoring encrypted traffic patterns, limiting the attackers' ability to extract sensitive operational information from critical infrastructure systems.

Impact (Mitigations)

Even with CNSF controls in place, some operational impact to critical infrastructure systems would likely have remained, though the scope of disruption across multiple facilities and extended downtime periods could have been significantly reduced.

Impact at a Glance

Affected Business Functions

  • Water Treatment Operations
  • Power Generation Systems
  • Critical Infrastructure Monitoring
  • Public Utility Services
Operational Disruption

Estimated downtime: 4 days

Financial Impact

Estimated loss: $2,500,000

Data Exposure

Potential exposure of industrial control system configurations, SCADA network topology, and operational technology parameters across water treatment facilities in 12 US states. UK power plant operational data and control systems were compromised during 4-day shutdown.

Recommended Actions

  • • Implement high-performance encryption (HPE) for all critical infrastructure communications to prevent interception of unencrypted SCADA/ICS traffic
  • • Deploy zero trust segmentation with least privilege access controls to prevent lateral movement between critical systems and limit blast radius
  • • Establish comprehensive east-west traffic security monitoring to detect and block unauthorized internal network movements
  • • Implement egress security and policy enforcement to prevent data exfiltration and unauthorized outbound communications from critical infrastructure
  • • Deploy multicloud visibility and anomaly detection capabilities to identify nation-state attack patterns and provide early warning of infrastructure targeting

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image