Coordinated Attack on Minnesota Water Infrastructure Targeting Rockwell Automation and Schneider Electric PLCs
A coordinated cyberattack targeted over 30 Minnesota water and wastewater utilities, leveraging internet-exposed industrial control systems (ICS) via cellular modems. The campaign utilized critical vulnerabilities in Rockwell Automation controllers (CVE-2021-22681, CVE-2023-3595, CVE-2024-6242) and targeted Schneider Electric and Siemens PLCs. Threat actors, attributed to the Iranian-linked CyberAv3ngers (IRGC-CEC), progressed to "Phase 4" capabilities, employing legitimate vendor engineering software to exfiltrate PLC project files and manipulate Add-On Instructions (AOIs) to disable safety protocols. This resulted in operational shutdowns in Braham and transitions to manual operations across multiple municipalities, though no water quality contamination was reported.
Iran-Linked MuddyWater Actors Compromising Rockwell Automation PLCs in U.S. Critical Infrastructure
Iranian state-sponsored group MuddyWater, affiliated with the Ministry of Intelligence and Security, is actively targeting U.S. critical infrastructure by exploiting internet-exposed Rockwell Automation Programmable Logic Controllers (PLCs). The attackers leverage these exposed OT interfaces to deploy SSH backdoors for persistent access. Once established, they manipulate SCADA display data to deceive industrial operators, masking the actual state of physical processes within the water, energy, and government sectors. This activity, detailed in CISA/FBI Joint Advisory AA26-097A, represents a direct effort to facilitate operational disruptions through the manipulation of Industrial Control Systems (ICS).