Iranian Actors Target US Water Utility PLCs: A Defense Guide for ICS Teams

CISA and the FBI have issued a joint advisory documenting attacks by Iranian state-affiliated actors against programmable logic controllers at water and wastewater utilities in multiple US states. The campaign exploits internet-exposed Rockwell Automation and Allen-Bradley PLCs that retain default credentials or use predictable authentication.

Attack pattern

The actors conduct internet-wide scanning for PLCs exposed on standard industrial protocol ports. Once a reachable device is identified with default or weak credentials, the actor logs in directly to the PLC's web interface or programming port and modifies operational parameters, including flow rates and chemical dosing setpoints.

CISA notes that the actors have not pursued destructive outcomes in most observed incidents. The primary behavior is parameter manipulation paired with ransom messaging displayed on HMI screens. The same access channel that produced benign manipulation could support more consequential changes, and CISA treats each intrusion as having latent destructive potential.

Why water utilities remain exposed

Water and wastewater utilities, particularly small and medium-sized facilities serving rural or suburban communities, face a combination of funding constraints, staff limitations, and legacy equipment that makes rapid security uplift difficult. PLCs purchased in the 2000s and early 2010s frequently have no concept of role-based access control, and authentication is typically a single shared password that is often left at the factory default.

Many facilities connected PLCs to the internet for remote monitoring without establishing a VPN gateway, relying on the assumption that the devices were obscure enough to avoid attention. Industrial protocol scanners index these devices continuously, and the assumption of obscurity does not hold.

Defense-in-depth for ICS environments

CISA's recommended controls, ordered by impact:

• Remove internet-facing access to PLCs immediately. If remote monitoring is required, route it through a VPN or secure industrial remote access gateway rather than direct internet exposure.
• Change default credentials on every PLC and HMI on the network and maintain a credential inventory.
• Implement network segmentation with a DMZ between corporate IT and OT networks. PLCs should not be reachable from general corporate endpoints.
• Enable logging on all network-connected OT equipment and forward logs to a SIEM or OT-specific monitoring platform.
• Establish a baseline of normal PLC parameter ranges and configure alerts on deviations. Many PLCs support setpoint range limits that reject out-of-band changes.

The Iranian campaign targeting water infrastructure is part of a pattern CISA has tracked since 2023. The techniques succeed not because they are sophisticated but because basic hardening steps have not been applied. For most affected utilities, the path to resilience does not require new technology. It requires applying existing controls to equipment that was left unprotected.

Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are assessing OT network security posture or ICS threat exposure.