Exposed Devices Attacked in US Water Systems

Minnesota – Scans of internet-connected industrial equipment found over 4,000 Rockwell Automation and Allen-Bradley controllers exposed online, including 22 in cities impacted by cyberattacks on U.S. water systems.

The findings, published Wednesday by Forescout’s Vedere Labs, show that direct internet access to equipment used in water and wastewater operations remains common despite years of warnings from manufacturers and federal agencies.

On July 28, Minesota IT Services (MNIT) reported a coordinated cyberattack against more than 30 water systems in the state. No city reported degraded water quality but Plymouth, South St. Paul, Maple Plain, and Braham confirmed operational impacts. Braham reported that threat actors used malware via a wireless connection to shut down water plant controls. Plymouth reported its affected equipment – two water towers and 14 sewer lift stations – were cellular-connected.

Two days later, the FBI and EPA issued a joint advisory confirming that water and wastewater utilities in at least 12 states observed similar incidents since July 27. Michigan,South Dakota, Georgia, have since been named — with nine systems affected in Michigan and one wastewater lift station in South Dakota. The advisory mentions that threat actors targeted Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers (PLCs) and that at least one victim organization had its PLC logic modified. In other cases, controllers were remotely accessed and reconfigured by changing IP addresses and passwords, causing loss of monitoring and control. Reported effects include pressure loss and flooding — which could allow untreated groundwater into drinking water pipes.

These attacks have not been attributed to a threat actor, but they were described as being “coordinated” by MNIT. Just four days before the Minnesota incident, CISA updated its advisory on Iranian-affiliated actors exploiting internet-exposed PLCs. Although some of the TTPs and devices mentioned in CISA’s advisory and the recent water sector incidents are similar, there is no confirmed link between the two.

The exposed devices use EtherNet/IP, an industrial protocol that allows for communication between control equipment, engineering workstations and other systems. When the port is open to the public internet, outside users may be able to identify devices and, depending on their setup, change settings or write new configurations.

The scan, run through the Shodan search engine Monday, found that 2,844 of the exposed controllers (65%) were in the United States.

Key Findings

• Recent attacks against internet-facing controllers in U.S. water systems show that exposed operational technology remains a significant concern.
• There are 4,407 internet-facing controllers exposing port 44818 (EtherNet/IP).
  • 65% are located in the U.S., followed by Canada (12%) and Spain (3%).
  • Exposed controllers decreased 47% from a high of 7,814 devices in March 2020 to a low of 4,169 in June 2026.
  • 70% of U.S.-based controllers are in large mobile network carrier networks, connected via cellular routers.
  • The most common family is MicroLogix 1400 (50%), followed by CompactLogix 1769 (22%), MicroLogix 1100 (8%) and ControlLogix 5590 (8%).
  • 22 hosts in this dataset were present in cities targeted in the current campaign.
• There is no confirmation of any CVE exploited in this campaign, but exposed controllers are often susceptible to known vulnerabilities.
  • The most prevalent CVE observed in the 22 hosts in the affected cities was CVE-2017-16740. Exploitation would require Modbus TCP to be enabled, which was not confirmed.
• Beyond controllers, our research found expired certificates, unrenewed remote-access hostnames and abandoned servers that indicate incomplete asset visibility on municipal utilities.

Recommended Mitigation

• Disconnect PLCs from the public internet
• Disable unused services
• Implement secure remote access
• Plan to replace end-of-life devices

About the Author

Wayne Creed

Administrator

View All Posts