The US Environmental Protection Agency (EPA) and the FBI have together issued a Public Service Advisory (Alert: I-073026-PSA) on improving cybersecurity of operational and edge technology in the country’s critical national infrastructure. The Advisory follows intelligence that hostile state actors are scaling up cyber attacks on US critical infrastructure, and that they are using increasingly sophisticated technology and strategies to attack weak points across the United States.

The particular catalyst for the Advisory was a coordinated cyber campaign in late July 2026 that compromised OT across more than 30 municipal water and wastewater facilities in Minnesota before cascading into at least six additional US states, including Michigan. Operators were forced to sever external network connections, in some cases physically cutting the cables, and revert to manual operational overrides to halt localised pressure loss and flooding.

While the attackers targeted municipal water facilities in the US, the devices that were targeted can be found across energy, manufacturing, transportation, logistics and many other sectors, not only in the United States but in Europe, Asia and elsewhere.

Cyber Attack Strategy & Tactics

The initial access vector began with automated public search engine mapping using platforms like Shodan, Censys, and FOFA. Threat actors executed queries targeting standard industrial control ports exposed to the open internet—specifically TCP 44818 (EtherNet/IP), TCP 102 (Siemens S7comm), and TCP 502 (Modbus TCP).

This reconnaissance identified unsegmented cellular modems operating on commercial carrier IP pools. Because these endpoints lacked basic virtual private network (VPN) wrappers or firewalls, they were exposed in public IP space, often secured only by factory default credentials.

Once edge access was established, the attackers exploited known vulnerabilities, most notably CVE-2021-22681. This authentication bypass in Rockwell Automation Logix controllers carries a CVSS score of 9.8 and allows unauthenticated remote attackers to send administrative commands via an insufficiently protected cryptographic key.

The operatives utilised vendor-native engineering software, such as Rockwell’s Studio 5000 Logix Designer and Siemens’ TIA Portal, routed through foreign virtual private servers. This enabled a technique known as Add-On Instruction (AOI) tampering. Attackers copied controller project files (such as .ACD and .ap17), modified reusable code modules, and reloaded them onto the PLCs. The altered AOIs maintained the appearance of normal downstream ladder logic, effectively inducing a “loss of view” condition. HMIs displayed normal operational parameters to human operators, while the modified logic silently disabled safety shutdown systems and suppressed alarm thresholds.

To maintain persistence across these edge devices, the attackers deployed a backdoor tracked as IOCONTROL. Compiled for 32-bit ARM, MIPS, and x86 embedded architectures, IOCONTROL converts compromised edge routers and cellular IoT gateways into persistent command-and-control (C2) proxies. The malware ensures its survival by writing execution entries into System V init directories (masquerading as legitimate scripts like /etc/rc3.d/S93InitSystemd.sh) and deploying a continuous watchdog process.

To evade deep packet inspection, IOCONTROL routes its C2 communications over the MQTT protocol using encrypted TLS (ports 8883/1883) and utilises DNS-over-HTTPS (DoH), allowing malicious telemetry to blend seamlessly into legitimate IoT background noise.

Cross-Sector Exposure

While the July 2026 campaign primarily disrupted water utilities, the targeted hardware is ubiquitous. Rockwell Automation MicroLogix controllers, Siemens SIMATIC S7 units, Schneider Modicon PLCs, and commercial cellular gateways form the physical backbone of nearly every critical infrastructure sector. The vulnerabilities exploited in Minnesota represent a systemic exposure across adjacent industries.

Industrial dairies, beverage production facilities, and commercial food processors rely heavily on the same Rockwell and Siemens controllers for chemical dosing, pasteurisation, and refrigeration. Unsegmented cellular modems installed by equipment vendors for remote diagnostics create identical initial access vectors, leaving the food supply chain vulnerable to logic overwrites that could spoil batches or alter chemical mixtures.

The energy sector utilises unmanned remote natural gas wellheads, oil storage fields, and electrical distribution sub-stations that depend on cellular Remote Terminal Units (RTUs) and PLCs to transmit telemetry data back to central control centres. A logic overwrite campaign mirroring the July 2026 tactics in this sector could trigger physical pipeline pressure drops, disable safety valve closures, or disrupt regional power distribution.

In transportation and logistics, municipal traffic control systems, automated rail switches, and maritime port logistics links rely heavily on edge cellular routers operating on commercial networks. Deployment of IOCONTROL or similar could see these edge devices allow state proxies to take control of isolated transit networks, manipulating signalling logic or halting automated port cranes.

Advice on Counter Measures

The EPA/FBI Advisory contained a list of counter measures and precautions that operators should implement to protect against such hostile state threats.

Enforce Physical Hardware State Controls
Organisations should move beyond software-defined security and employ physical fail-safes. For controllers equipped with a physical key switch (such as Rockwell ControlLogix or Siemens SIMATIC PLCs), operators should place the hardware switch firmly in the RUN position during normal operations. This physically blocks remote logic downloads, program overwrites, or firmware updates across the network, regardless of the software privileges an attacker may have acquired. REMOTE or PROGRAM modes should be strictly limited to active, monitored maintenance windows.

Isolate Cellular Links from Public IP
Operators should remove cellular modems from public Wide Area Network (WAN). Edge connectivity should be migrated to Private Access Point Names (APNs), cellular Software-Defined Wide Area Networks (SD-WAN), or Zero Trust Network Access (ZTNA) overlays that prohibit inbound connections from the internet. All remote management should be forced through an intermediate jump host or secure gateway requiring multi-factor authentication (MFA).

Mandatory Supply-Chain Security Standards
Procurement contracts should be rewritten to include mandatory supply-chain security standards and explicit audit rights for system integrators. Vendors should be contractually prohibited from deploying edge devices with default credentials or unsegmented public IPs, and organisations should conduct thorough attack-surface reviews to inventory undocumented or legacy cellular links installed during third-party servicing.

Analyst Reactions to Advisory

While cybersecurity practitioners welcomed the Advisory’s directives on cellular gateway architecture and hardware key positions, it was criticised by policy analysts and legal firms. The central critique is the United States’ continued reliance on voluntary guidance in the face of escalating nation-state threats.

Unlike the North American bulk electric power system, which is governed by mandatory, enforceable NERC CIP standards with substantial non-compliance fines, the US water and wastewater sector remains subject to a patchwork of voluntary performance goals under Section 1433 of the Safe Drinking Water Act.

Legal analysts noted that issuing PSAs after an intrusion occurs does little to solve the structural vulnerabilities of the sector. When the EPA previously attempted to mandate cybersecurity audits through state sanitary surveys, the effort was struck down in federal court in 2023 following industry legal challenges citing regulatory overreach and unfunded mandates.

Such reliance on voluntary adoption contrasts with peer nations that treat OT cybersecurity as a legally binding operational requirement.

Further Reading & Official Guidance

For further details and resources on technical mitigation strategies, and regulatory frameworks discussed above, see the following:

• FBI and EPA Public Service Announcement (Alert: I-073026-PSA): Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions (Issued 30 July 2026). https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions
• CISA Advisory AA26-097A The joint federal advisory detailing the expanded technical indicators of compromise (IoCs), including the exploitation of CVE-2021-22681, Add-On Instruction (AOI) tampering, and the targeting of Siemens and Schneider Electric controllers by IRGC-aligned actors. https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions
• EPA’s Cybersecurity Technical Assistance Program for the Water Sector: https://www.epa.gov/cyberwater/forms/cybersecurity-technical-assistance-program-water-sector
• NJCCIC Threat Profile: CyberAv3ngers: https://cyber.nj.gov/Home/Components/News/News/1550/
• Internet Crime Complaint Center (IC3): https://www.ic3.gov