Between the 26th and 27th of July 2026, a coordinated cyberattack compromised operational technology (OT) across more than 30 municipal water and wastewater systems in Minnesota, before cascading into at least six other US states, including Michigan. The intrusions forced facilities in municipalities such as Plymouth, Braham, and South St. Paul to sever external network connections and revert to manual operational overrides.

This was not a deployment of bespoke, destructive malware akin to Stuxnet. Instead it was a systematic exploitation of structural negligence at the network edge by US infrastructure operators. The attackers bypassed traditional enterprise IT defences entirely, targeting decentralised, unsegmented cellular IoT modems and internet-facing Programmable Logic Controllers (PLCs).

The attack, almost certainly arising from Iran, heavily utilised Open Source Intelligence (OSINT), in particular US Government agency circulars, to pinpoint vulnerabilities in US critical and operational infrastructure, and to craft attack strategies.

Attribution to IRGC-Aligned Cyber Attackers

Federal investigators and the US Water Information Sharing and Analysis Centre (WaterISAC) have provisionally attributed the campaign to CyberAv3ngers, a group that appears to operate under the direction of Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC).

While the cybersecurity industry frequently observes state-backed actors engaging in espionage or intellectual property theft, the IRGC-CEC’s operational mandate here appears psychological and disruptive.

Historically, CyberAv3ngers have relied on low-sophistication hacktivist theatre—defacing Human-Machine Interfaces (HMIs) and publishing exfiltrated project files on Telegram. However, this recent series of attacks is a marked escalation in tradecraft. The group has transitioned from superficial defacements to persistent, deep-level manipulation of physical operational control systems, signalling a strategic intent to force Western utilities into costly, manual operational states without crossing the threshold into kinetic destruction.

Tactics and Attack Surfaces

The primary initial access vector relied on secondary communications infrastructure. The attackers targeted remote physical assets, such as lift stations, wellheads, and elevated water towers, to gain access to central SCADA networks via cellular modems and gateways. The municipal water infrastructure edge networks, which have typically been installed by installed by third-party integrators, have been shown to lack network segmentation and are visible to internet-wide port scans.

Once the attackers identified these unsegmented cellular modems operating on public commercial IP pools, they pivoted to their core operational targets: embedded PLCs manufactured by Rockwell Automation, Siemens, Schneider Electric, and Unitronics.

Rather than deploying automated malware payloads, the attackers employed vendor-native engineering software such as Rockwell’s Studio 5000 Logix Designer and Siemens’ TIA Portal, routed through foreign virtual private servers. This allowed them to interface directly with the exposed controllers over standard industrial protocols, including EtherNet/IP (TCP 44818), S7comm (TCP 102), and Modbus TCP (TCP 502).

Sophisticated element of the attack involved manipulation of Add-On Instructions (AOIs). Attackers exfiltrated the controller project files, modified these reusable code modules, and reloaded them onto the PLCs. The altered AOIs maintained the appearance of normal downstream ladder logic, effectively creating a “loss of view” condition for the human operators monitoring the SCADA displays. While the HMIs presented normal operational parameters, the modified logic silently disabled safety shutdown systems and suppressed alarm thresholds.

This access was facilitated by the exploitation of known vulnerabilities, most notably CVE-2021-22681, a critical authentication bypass in Rockwell Automation Logix controllers carrying a CVSS score of 9.8. By exploiting an insufficiently protected cryptographic key, unauthenticated remote attackers were able to send administrative commands and alter PLC configurations at will.

IOCONTROL: The Edge Proxy

To maintain persistence and facilitate lateral movement across these decentralised networks, the attackers deployed a modular Linux backdoor tracked as IOCONTROL. Compiled primarily for 32-bit ARM, MIPS, and x86 embedded architectures, IOCONTROL is engineered specifically to compromise edge routers, cellular IoT gateways, and IP cameras, converting them into persistent command-and-control (C2) proxies.

The malware’s persistence mechanisms appear to be robust. During installation, it writes execution entries into System V init directories, masquerading as legitimate system scripts (e.g., /etc/rc3.d/S93InitSystemd.sh). It simultaneously deploys a background watchdog process that continuously monitors the binary; if the process crashes or is terminated, the watchdog immediately respawns it.

IOCONTROL’s most notable feature is its evasion architecture. To bypass traditional network monitoring and deep packet inspection, the backdoor routes its C2 communications over the MQTT (Message Queuing Telemetry Transport) protocol using encrypted TLS on ports 8883 and 1883. Because MQTT is the standard protocol for legitimate IoT telemetry, the malicious traffic seamlessly blends into the background noise of the operational network. Furthermore, the binary utilises DNS-over-HTTPS (DoH) to resolve its C2 domains, preventing local firewalls or ISPs from inspecting or sinkholing the malicious DNS lookups.

Once established on the cellular edge, IOCONTROL executes built-in port-scanning modules designed to map the internal operational subnets, specifically searching for local PLCs communicating over industrial protocols. This allows the attackers to pivot from a compromised, internet-facing cellular modem directly into the isolated OT environment.

The Weaponisation of OSINT

A significant aspect of the attack is CyberAv3ngers’ use of Open Source Intelligence (OSINT). The IRGC-aligned hackers did not require complex network-reconnaissance malware; they mapped their target environments using public IoT search engines such as Shodan, Censys, and FOFA.

By executing automated queries targeting standard industrial control ports (such as TCP 44818 and TCP 502), the attackers easily identified unsegmented cellular modems on commercial carrier IP ranges. Because these endpoints lacked basic VPN wrappers or private Access Point Names (APNs), they were entirely exposed in public IP space.

Furthermore, the campaign relied exclusively on public vulnerability disclosures and vendor documentation. Proof-of-concept code for CVE-2021-22681 provided the exact cryptographic bypasses required. Operating manuals for software suites like Studio 5000 detailed precisely how project files and AOIs are compiled, allowing operatives to craft targeted logic modifications. Threat intelligence indicates the group integrated generative AI tools to accelerate this process, using large language models to parse complex technical documentation, draft target-scraping scripts, and debug ladder-logic modifications.

There is an irony in the targeting methodology: public sector warnings inadvertently provided the Iranian attackers with their strategic roadmaps. When federal agencies published reports highlighting that small-to-midsize utilities lacked dedicated OT security teams, or when vendors issued advisories listing vulnerable hardware models, the threat actors simply updated their Shodan search filters with those exact model designations. Regulatory transparency, in this instance, directly assisted adversary reconnaissance.

Damage Caused by Attackers

The physical consequences of the intrusions, while disruptive, were contained by the inherent resilience of municipal engineering. The alterations to PLC logic and the subsequent lockout of local operators led to degraded system operations across the affected states. In several locations, the disruption of remote supervisory controls resulted in localised pressure loss within distribution pipes and flooding at wastewater lift stations.

However, the primary impact was operational rather than kinetic. Upon detecting the anomalies, affected facilities immediately disconnected their internet-facing edge links and transitioned to physical, manual operations to maintain service. A small number of communities were forced to issue temporary boil-water notices as a precaution during this transition period.

Both state environmental health departments and federal agencies have confirmed that drinking water quality and safety remained uncompromised, with no evidence of chemical dosing alterations or toxic contamination. The fail-safes inherent in water treatment physics ultimately mitigated the digital compromise.

The EPA & FBI Advisory

We shall shortly publish an extensive analysis of the joint advisory (AA26-097A) issued by CISA, the FBI, and the EPA in response to these attacks.

In brief, the federal guidance mandates a fundamental re-evaluation of edge connectivity. The advisory instructs critical infrastructure operators to immediately audit their public IP footprints and physically disconnect exposed PLCs, cellular gateways, and remote terminal units from the open internet. Among the most critical hardware-level mitigations recommended is the enforcement of physical RUN modes on controllers equipped with hardware key switches, thereby physically blocking remote logic downloads regardless of software privileges.

The events of late July underscore the extent to which the convergence of IT and OT has expanded attack surfaces far beyond traditional enterprise security. When cellular modems and embedded controllers are deployed without rigorous segmentation, the network edge becomes a liability that adversaries are increasingly equipped to exploit.