Executive Summary
Throughout summer 2024, water utilities across the United States faced a sustained campaign of cyberattacks primarily attributed to Iranian threat actors, targeting internet-exposed operational technology (OT) systems and programmable logic controllers (PLCs). The attacks exploited aging infrastructure built for durability rather than cybersecurity, with attackers gaining initial access through exposed OT systems, vulnerable PLCs, and compromised integrator connections. The incidents prompted the Water Information Sharing and Analysis Center (WaterISAC) to accelerate threat intelligence sharing and partner with Cyware to enhance sector-wide cyber defense capabilities.
These attacks underscore the growing threat to critical infrastructure as nation-state actors increasingly target industrial control systems amid escalating global tensions. The incidents highlight the vulnerability of legacy OT environments and demonstrate how threat actors are exploiting the convergence of IT and OT networks to compromise essential services.
Why This Matters Now
Water utility attacks represent a critical escalation in nation-state targeting of essential infrastructure, with Iranian, Chinese, and Russian actors actively exploiting legacy OT systems that millions depend on daily for clean water services.
Attack Path Analysis
State-sponsored actors targeted water utility infrastructure by exploiting internet-exposed operational technology and vulnerable programmable logic controllers, using compromised integrator connections and phishing attacks to gain initial access, then escalating privileges through legacy OT systems lacking proper authentication controls, moving laterally across unsegmented industrial networks, establishing command and control through compromised OT devices, exfiltrating sensitive operational data and system configurations, ultimately impacting water treatment operations and potentially disrupting service delivery to communities.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers gained access through internet-exposed OT systems, vulnerable PLCs, compromised integrator connections, or phishing attacks targeting utility employees
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Phishing: Spearphishing Attachment
Trusted Relationship
Valid Accounts
Brute Force
Traffic Signaling
Data Destruction
Service Stop
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
CISA Zero Trust Maturity Model 2.0 – Network Segmentation Implementation
Control ID: NE.L2.Im.1
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.15
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
DORA – ICT Third-party Risk Management
Control ID: Article 11
PCI DSS 4.0 – Multi-factor Authentication for Remote Access
Control ID: 11.4.7
ISO 27001:2022 – Web Filtering
Control ID: A.8.23
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Utilities
Primary target of state-sponsored attacks on water infrastructure with exposed OT systems, vulnerable PLCs requiring zero trust segmentation and encrypted traffic protection.
Government Administration
Critical infrastructure oversight responsibilities amid Iranian state-sponsored targeting, requiring enhanced visibility controls and egress security for inter-agency coordination and threat response.
Information Technology/IT
Integrator connections create lateral movement vulnerabilities in water systems, necessitating east-west traffic security and multicloud visibility to prevent privilege escalation attacks.
Computer/Network Security
Threat intelligence sharing platforms and anomaly detection capabilities essential for water sector protection against state-sponsored infrastructure targeting and malicious payload delivery.
Sources
- WaterISAC reckons with range of threats after summer of cyberattackshttps://cyberscoop.com/water-utility-cyberattacks-waterisac-cyware-threat-intelligence/Verified
- CISA Alert: Iranian Cyber Actors Compromise Water and Wastewater Systems Facilitieshttps://www.cisa.gov/news-events/alerts/2023/11/30/iranian-cyber-actors-compromise-water-and-wastewater-systems-facilitiesVerified
- CISA Water and Wastewater Systems Security Guidelineshttps://www.cisa.gov/water-and-wastewater-systems-sectorVerified
- NSA and CISA Release Cybersecurity Information Sheet on Securing Water and Wastewater Systemshttps://www.nsa.gov/Press-Room/News-Highlights/Article/Article/3215760/nsa-and-cisa-release-cybersecurity-information-sheet-on-securing-water-and-waste/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would likely constrain this water utility attack by segmenting industrial networks and limiting lateral movement between OT systems. The attack's blast radius across unsegmented infrastructure would be significantly reduced through workload isolation and controlled access paths.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Initial access to internet-exposed OT systems would likely be constrained through secure cloud connectivity and reduced attack surface exposure to critical industrial infrastructure.
Control: Zero Trust Segmentation
Mitigation: Privilege escalation across legacy OT systems would likely be limited through identity-aware access controls and workload-level segmentation that constrains lateral privilege expansion within industrial networks.
Control: East-West Traffic Security
Mitigation: Lateral movement between OT systems and PLCs would likely be significantly constrained through east-west traffic inspection and segmented communication paths across the industrial network infrastructure.
Control: Multicloud Visibility & Control
Mitigation: Command and control establishment through compromised OT devices would likely be detected and constrained through enhanced visibility and monitoring of communication patterns across the industrial infrastructure.
Control: Egress Security & Policy Enforcement
Mitigation: Data exfiltration of operational configurations and infrastructure details would likely be constrained through controlled egress policies and restricted outbound communication paths from industrial systems.
While some operational disruption may still occur, the scope of impact would likely be reduced to isolated segments rather than cascading across the entire water treatment infrastructure network.
Impact at a Glance
Affected Business Functions
- Water Treatment Operations
- Water Distribution Systems
- SCADA Monitoring and Control
- Public Water Safety Compliance
Estimated downtime: 3 days
Estimated loss: $150,000
Potential exposure of operational technology system configurations, water treatment control parameters, and infrastructure operational data. No indication of customer PII exposure, but compromise of critical infrastructure control systems poses significant public safety risks.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust segmentation to isolate OT systems and PLCs from internet exposure and prevent lateral movement across industrial networks
- • Deploy encrypted traffic protection (HPE) with MACsec and IPsec to secure data in transit between operational technology systems
- • Establish east-west traffic security controls to monitor and restrict workload-to-workload communications within industrial environments
- • Enable multicloud visibility and control to detect anomalous interactions and suspicious automation targeting critical infrastructure
- • Implement egress security and policy enforcement to prevent data exfiltration and block unauthorized outbound communications from OT networks
