FlagThis
← Back to Daily Briefing

Coordinated Attack on Minnesota Water Infrastructure Targeting Rockwell Automation and Schneider Electric PLCs

Published July 31, 2026
Campaign Analysis🏢 Rockwell Automation#RockwellAutomation#CyberAv3ngers#IRGC-CEC#OTSecurity#CriticalInfrastructure

A coordinated cyberattack targeted over 30 Minnesota water and wastewater utilities, leveraging internet-exposed industrial control systems (ICS) via cellular modems. The campaign utilized critical vulnerabilities in Rockwell Automation controllers (CVE-2021-22681, CVE-2023-3595, CVE-2024-6242) and targeted Schneider Electric and Siemens PLCs. Threat actors, attributed to the Iranian-linked CyberAv3ngers (IRGC-CEC), progressed to "Phase 4" capabilities, employing legitimate vendor engineering software to exfiltrate PLC project files and manipulate Add-On Instructions (AOIs) to disable safety protocols. This resulted in operational shutdowns in Braham and transitions to manual operations across multiple municipalities, though no water quality contamination was reported.

  • Incident Overview & Scope

    • Targeted over 30 Minnesota communities within a 48-hour window on July 26-27, 2026.
    • Primary targets were small, rural utilities relying on cellular-connected OT equipment without robust network segmentation.
    • Operational impacts included plant shutdowns in Braham and a declared state of emergency in Maple Plain.

  • Technical Exploitation Vectors

    • Exploited CVE-2021-22681 (CVSS 9.8) to achieve critical authentication bypass in Rockwell Automation Logix controllers.
    • Utilized CVE-2023-3595 and CVE-2024-6242 to facilitate remote code execution and bypass "Trusted Slot" security features.
    • Deployed Dropbear SSH on victim modems to establish persistent remote access to the OT environment.

  • Advanced TTPs & Payload Analysis

    • Utilized legitimate vendor tools (Studio 5000, EcoStruxure Control Expert, TIA Portal) to masquerade as authorized engineering personnel.
    • Manipulated Add-On Instructions (AOIs) to suppress alarms and bypass safety protocols, potentially enabling undetected physical damage.
    • Altered HMI and SCADA display data to mask unsafe system conditions from human operators.
    • Exfiltrated proprietary PLC project files via third-party hosted infrastructure for further offline analysis.

  • Threat Actor Profile: CyberAv3ngers (IRGC-CEC)

    • Attribution points to the Iranian-linked CyberAv3ngers ecosystem acting in retaliation for U.S. kinetic operations ("Operation Epic Fury").
    • Deployment of the IOCONTROL malware platform, specifically engineered for the takeover of IoT and OT devices.
    • Demonstrated a strategic shift from simple credential abuse to deep exploitation of vendor-specific engineering protocols.

  • Systemic Risks & Mitigation

    • Highlighting a critical vulnerability: 74.6% of global internet-exposed Rockwell Automation devices are located in the U.S.
    • Over 70% of U.S. water systems are currently failing to comply with mandatory risk assessment laws.
    • Urgent recommendation to decommission internet-exposed PLC management interfaces and implement strict hardware-based network segmentation.

Related posts

  1. blackswan-cybersecurity.com — THREAT ADVISORY Iranian-Affiliated Cyber Operations Targeting U.S. Water, Energy, and Critical Infrastructure Sectors July 27, 2026
  2. techjacksolutions.com — CISA Joint Advisory AA26-097A Updated: Iranian State-Affiliated Actors Modifying PLC Safety Logic in U.S. Critical Infrastructure, Scope Expanded to Siemens and Schneider Electric
  3. TechNadu — Coordinated Cyberattack Hits 30+ Minnesota Water Systems as Officials Suggest Iran-Linked Pattern
  4. it.slashdot.org — More Than 30 Minnesota Water Systems Targeted In Cyberattack
  5. Malware News — Coordinated Cyberattacks Hit Dozens of Minnesota Water Utilities, Raising Questions of Link to T-Mobile Outage
  6. feeds.feedburner.com — Coordinated Cyberattack Targets 30+ Minnesota Water Systems as One Plant Goes Offline
  7. csoonline.com — A coordinated attack hit 30+ Minnesota water systems. Who did it, and what does a Rockwell notice add to the picture?
  8. it.slashdot.org — Hackers Targeted Municipal Water Systems In 7 States This Week, FBI Says
  9. Wired Security — 7 States’ Water Systems Hit by Cyberattacks Likely Tied to Iran
  10. Security Affairs — CISA Urges Utilities to Remove Internet-Exposed PLCs After Minnesota Attacks
  11. The Register - Security — Water system cyberattacks spread to Georgia, Michigan amid US-Iran conflict
  12. SOCFortress — Vulnerabilities in Internet-Facing Industrial Control Systems
  13. malware-log.hatenablog.com — LevelBlue review finds attackers exploited exposed PLCs and remote access to disrupt US water infrastructure
  14. techjacksolutions.com — US Water Cyberattacks Extend Beyond Minnesota to at Least 6 Other States
  15. Schneier on Security — Iran Cyberattacks Against Minnesota Water Systems
  16. The Record by Recorded Future — Cyberattacks on water systems expand to 12 states as South Dakota, Georgia announce incidents
  17. serisec.com — Multistate Water System Attacks Widen, Iran Suspected
  18. Security Affairs — Iran-Linked Hackers Target More US Water Infrastructure in New Jersey and Alabama
  19. SecurityWeek — CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs
  20. Dark Reading — Minnesota Water Utility Attacks Expose Sector's Cyber-Risks
  21. cybersecuritydive.com — CISA, FBI warn that Iran-linked hackers are expanding target set for water, energy
  22. techjacksolutions.com — CISA Warns of Iranian-Affiliated Actors Targeting Industrial Control Systems
  23. gbhackers.com — Iranian Hackers Exploit Rockwell, Schneider and Siemens PLCs Across U.S. Critical Infrastructure
  24. Cybersecurity News — Iranian Hackers Are Disabling Industrial Safety Alarms and Hiding It From Operators
  25. cybrsecmedia.com — CISA Warns: Iranian Cyber Campaign Now Threatens "Potentially All" Exposed PLCs
  26. Infosecurity-magazine
  27. cyberscoop.com — Coordinated cyberattack disrupts water utilities in 30+ Minnesota communities
  28. cybersecuritydive.com — Authorities investigating a coordinated cyberattack against Minnesota water systems
  29. Tenable Blog — Coordinated “cyberattack” on Minnesota water utilities: What you need to know
  30. Rescana
  31. Nationalcioreview
  32. Mprnews
  33. CISA RSS — CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
  34. Industrial Cyber — Minnesota water cyberattacks prompt CISA warning on growing threats targeting internet-exposed PLCs
  35. bleepingcomputer.com — CISA warns of cyberattacks disrupting U.S. water utilities
  36. The Record by Recorded Future — CISA warns of spike in attacks on water systems as Minnesota incidents probed
  37. Cybersecuritydive
  38. Meritalk
  39. Nextgov
  40. Cbsnews
  41. Reddit
  42. Industrial Cyber — FBI and EPA warn hackers target internet-connected PLCs at US water utilities, leading to operational disruptions
  43. feeds.feedburner.com — ⚡ Weekly Recap: Rogue AI Models, $88M Bitcoin Theft, Water-System Attacks and Dangling DNS Hijacks
  44. levelblue.com — Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems
  45. Theguardian
  46. Industrial Cyber — LevelBlue review finds attackers exploited exposed PLCs and remote access to disrupt US water infrastructure
  47. Wflaorlando
  48. Newsweek
  49. Computing
  50. Columbiagorgenews
  51. Timesnews
  52. Ajc
  53. Dragos
  54. Emberot
  55. Waterisac
  56. Dragos
  57. Youtube
  58. Koeed
  59. Facilitiesdive
  60. Dispel
  61. Cbsnews
  62. Weisradio
  63. Wanaen
  64. Tomshardware
  65. Darkreading
  66. Cybermagazine
  67. SecurityWeek — Dozens of Minnesota Water Utilities Targeted in Coordinated OT Attacks
  68. SecurityWeek — Water Sector Cyberattacks Reportedly Hit at Least 12 States
  69. SecurityWeek — New Jersey, Alabama Join States Targeted in Water Cyberattacks
LINK COPIED TO CLIPBOARD