Listen to this Post
Introduction: When the Water Infrastructure Becomes the Target
Water infrastructure is one of those systems most people rarely think about until something goes wrong. Every day, pumps move water, valves regulate pressure, treatment systems maintain safety, and monitoring equipment quietly keeps entire communities functioning. Behind many of these operations are industrial control systems, programmable logic controllers, human-machine interfaces, and remote terminal units.
The July 2026 cyberattacks against more than 100 internet-exposed systems in the U.S. water and wastewater sector demonstrate how quickly an ordinary technology mistake can become a serious operational security problem. According to the original report, attackers were able to reach exposed programmable logic controllers, change IP addresses and passwords, interfere with alarms and shutdown mechanisms, and disrupt operators’ ability to monitor or control equipment.
What makes the situation particularly alarming is that the attackers did not necessarily need an extraordinarily sophisticated exploit. In many cases, the weakness was much simpler: industrial equipment was directly reachable from the public internet.
That is exactly why the Cybersecurity and Infrastructure Security Agency, or CISA, responded with exposure-reduction guidance designed to help organizations discover these weaknesses before attackers discover them first.
The July Attacks Exposed a Familiar Problem
The central lesson from the attacks is uncomfortable but straightforward. Some water and wastewater organizations had industrial devices that could be reached directly from the internet, including PLCs connected through cellular modems without adequate firewalling or intermediary security gateways.
PLCs are designed to control physical processes. They can operate pumps, valves, motors, sensors, and other machinery. They were never intended to function like ordinary internet-facing web servers.
When such equipment becomes directly accessible from the internet, the consequences can extend far beyond stolen information.
An attacker who gains sufficient access may potentially interfere with the physical process itself.
PLCs Are Small Computers With Big Responsibilities
A programmable logic controller may look like a specialized industrial box, but from a cybersecurity perspective it is still a computing device.
It receives information from sensors, executes programmed logic, and sends commands to physical equipment. In a water facility, that can mean controlling when pumps start, when valves open or close, or how different stages of a process operate.
That makes unauthorized access particularly dangerous.
A compromised office computer might expose documents, credentials, or email. A compromised PLC can potentially affect the machinery responsible for a real-world operation.
Cellular Modems Can Create Unexpected Exposure
The use of cellular connectivity is not inherently insecure. Remote connectivity can be extremely valuable for utilities that operate facilities across large geographic areas.
The problem arises when convenience replaces architecture.
If a cellular modem gives an industrial controller a publicly reachable path without appropriate security controls, the device can become visible to attackers conducting automated internet reconnaissance.
CISA specifically warned that directly connecting PLCs to the internet through cellular modems can create significant security risks.
The important distinction is that CISA is not saying every remote connection must disappear.
Instead, unnecessary remote access should be removed, while legitimate remote access should be placed behind appropriate security controls.
Attackers Changed IP Addresses and Passwords
The reported activity demonstrates why exposure of industrial systems is more than a theoretical concern.
Attackers reportedly remotely accessed exposed PLCs and made configuration changes, including changing device IP addresses and passwords.
In some cases, attackers also disabled shutdown processes and alarms.
That is particularly concerning because alarms and shutdown mechanisms exist precisely to help operators respond when something abnormal happens.
If an attacker can interfere with both the machinery and the mechanisms designed to alert operators, the defender’s visibility can disappear at the moment it is needed most.
Losing Visibility Can Be as Dangerous as Losing Control
Cybersecurity discussions often focus on whether an attacker can execute commands.
Industrial environments introduce another critical question: can legitimate operators still see what is happening?
A facility may continue running while its operators lose reliable monitoring capabilities. That creates uncertainty, and uncertainty in a physical environment can quickly become dangerous.
The reported incidents demonstrate this distinction clearly. The attackers were not simply trying to steal files. They interfered with monitoring and control functionality.
CISA Turns Reconnaissance Into Defensive Reconnaissance
One of the strongest parts of CISA’s guidance is its emphasis on seeing the organization from an attacker’s perspective.
Attackers routinely scan the internet looking for exposed services, forgotten systems, weak configurations, and outdated infrastructure.
Organizations should therefore conduct the same type of discovery against their own authorized assets.
Tools such as Shodan and Censys can help security teams understand what their infrastructure looks like from the public internet, while CISA’s Cyber Hygiene Vulnerability Scanning service can provide another way to identify externally visible weaknesses.
The objective is not to attack the organization.
The objective is to discover what the internet can already see.
An Open Port Is a Warning Sign, Not Proof of Compromise
Finding an exposed industrial protocol does not automatically mean that an organization has been breached.
That distinction is important.
An open port represents exposure. It should trigger investigation, asset identification, risk assessment, and remediation, but it should not automatically be treated as evidence that an attacker has successfully entered the system.
The problem is that exposed industrial services can attract automated reconnaissance.
Once a system becomes visible, defenders lose the advantage of obscurity.
Industrial Protocols Deserve Special Attention
Traditional enterprise environments commonly expose services such as SSH, RDP, and HTTP.
Industrial environments introduce another layer of concern.
CISA’s guidance highlights protocols including Modbus, EtherNet/IP, DNP3, BACnet, and OPC UA.
These protocols serve legitimate operational purposes, but their presence on an internet-facing system should receive careful scrutiny.
A security team should ask a basic question about every externally accessible industrial service:
Does this service genuinely need to be reachable from the public internet?
If the answer is no, exposure should be removed.
Remote Access Should Pass Through a Security Gateway
For organizations that genuinely need remote access, eliminating connectivity altogether may not be practical.
Maintenance teams may need to reach equipment located far from headquarters. Engineers may need emergency access. Distributed facilities may depend on centralized monitoring.
The safer model is architectural rather than absolute.
Instead of allowing the internet to communicate directly with a PLC, HMI, or RTU, remote connections should pass through a centrally managed security layer.
That can include a secure gateway, firewall, VPN, or another controlled access mechanism.
The industrial device should not have to face the internet directly just because an engineer needs remote access.
Multi-Factor Authentication Raises the Barrier
Remote-access infrastructure should also require strong authentication.
Phishing-resistant multi-factor authentication is particularly valuable because passwords alone are increasingly vulnerable to theft, reuse, phishing, credential stuffing, and social engineering.
A compromised password should not automatically provide a straight path into industrial infrastructure.
Organizations should also eliminate shared default credentials wherever possible and ensure that accounts are unique and traceable.
Accountability matters.
If ten engineers share one administrator password, determining who performed a configuration change becomes considerably harder.
Monitoring Needs to Continue After Access Is Granted
Authentication is not the end of the security process.
Organizations should monitor traffic entering and leaving industrial environments and establish alerts for unusual activity.
A remote login at an expected time from an approved location might be normal.
A login followed by an unexpected IP-address change, password modification, alarm configuration change, or unusual control activity should receive immediate attention.
Security teams need visibility into behavior, not merely authentication events.
The Real Problem Is Security Hygiene
Perhaps the most frustrating part of this incident is that the fundamental defensive recommendations are not revolutionary.
Do not expose industrial control systems directly to the internet.
Remove unnecessary remote access.
Use firewalls and secure gateways.
Require strong authentication.
Replace default credentials.
Monitor network activity.
Maintain accurate asset inventories.
These are basic cybersecurity principles.
The difference is that the consequences become dramatically more serious when the vulnerable endpoint controls physical infrastructure.
The Threat Is Larger Than Water Utilities
The reported attacks should not be viewed as an isolated water-sector incident.
Critical infrastructure has increasingly become a strategic target for nation-state-linked threat actors.
Cybersecurity agencies have repeatedly warned about campaigns targeting energy, telecommunications, transportation, manufacturing, water, and other critical services.
The concern is not necessarily that attackers will immediately shut down an entire country.
A more realistic danger can involve quiet access, reconnaissance, credential theft, configuration changes, and preparation for a future crisis.
Volt Typhoon Changed the Conversation
Reports surrounding
That strategy changes the meaning of cybersecurity.
The question is no longer simply:
Are we being attacked today?
It becomes:
“Could someone already be inside our infrastructure waiting for the right moment?”
That is why exposed PLCs should be treated seriously even when there is no evidence of compromise.
An Exposed PLC Is an Unnecessary Risk
There is a major difference between an intentionally remote-accessible industrial system protected behind multiple security layers and a PLC that simply happens to be reachable from the public internet.
The first can be a business requirement.
The second can be an architectural mistake.
Organizations should aggressively reduce the second category.
Security teams should know every externally visible industrial asset, understand why it is exposed, and have a documented reason for keeping that exposure.
Deep Analysis: How Defenders Can Investigate Exposure
Authorized External Discovery
Security teams can begin by identifying their
For authorized assets, basic reconnaissance can help determine whether unexpected services are visible:
nmap -sV -Pn <AUTHORIZED_IP>
This should only be performed against infrastructure the organization owns or has explicit permission to test.
Checking Specific Industrial Ports
A focused assessment can examine commonly encountered industrial services:
nmap -Pn -p 502,44818,20000,4840 <AUTHORIZED_IP>
These ports can correspond to protocols such as Modbus/TCP, EtherNet/IP, DNP3, and OPC UA.
An open port does not prove compromise. It identifies a service that deserves investigation.
Reviewing Unexpected Services
For broader authorized testing, defenders can enumerate exposed TCP services:
nmap -Pn -sV --open <AUTHORIZED_IP>
The results should be compared against the
If the inventory says an address belongs to an ordinary business server but external scanning identifies an industrial service, that discrepancy deserves immediate investigation.
Inspecting Firewall Rules
Linux-based gateways can provide a quick view of filtering rules:
sudo nft list ruleset
Organizations using other firewall platforms should similarly review inbound rules and verify that industrial services are not unnecessarily exposed.
Reviewing Listening Services
On a Linux gateway or server:
sudo ss -tulpn
This can help identify locally listening services that may unintentionally become reachable through firewall or routing configuration.
Searching for Internet Exposure
Security teams can use authorized exposure-monitoring services to compare their known assets against what is visible externally.
The most important operational question is not simply:
What ports are open?
It is:
“Why is each one open, who needs it, and what security control stands between that service and the public internet?”
Investigating Configuration Changes
If suspicious changes are discovered, teams should examine logs and configuration history.
For example:
sudo journalctl --since "24 hours ago"
The exact logging mechanisms will differ dramatically between Linux systems, Windows infrastructure, PLC platforms, HMIs, and vendor-specific industrial systems.
The principle remains the same: establish a timeline.
Preserve Evidence Before Resetting Systems
If an industrial device appears compromised, immediately changing everything without preserving evidence can destroy useful forensic information.
Incident responders should document observed IP addresses, account changes, configuration modifications, timestamps, network connections, and alarms.
Industrial environments also require caution because indiscriminate rebooting or configuration changes can affect physical operations.
What Undercode Say:
The Simplest Vulnerability Can Become the Biggest Problem
The most important lesson from these attacks is not about a sophisticated zero-day.
It is about exposure.
Visibility Is the First Layer of Defense
Organizations cannot protect assets they do not know exist.
Internet Exposure Should Be Treated as an Inventory Problem
Every public-facing industrial endpoint should have an owner and a documented purpose.
Forgotten Infrastructure Is Dangerous Infrastructure
Legacy systems are often forgotten because they continue working.
Working Does Not Mean Secure
A PLC can operate perfectly while remaining dangerously exposed.
Convenience Often Creates Security Debt
Direct remote connectivity may be easy to deploy but expensive to defend.
Cellular Connectivity Needs Security Architecture
A cellular modem should not automatically become an internet gateway to an industrial controller.
Remote Access Is Not the Enemy
Poorly controlled remote access is the problem.
Secure Gateways Create Separation
The internet should not have a direct relationship with physical control equipment.
Segmentation Matters
Industrial control systems should be separated from ordinary corporate networks and public-facing services.
Authentication Must Be Strong
Default passwords and shared credentials create unnecessary opportunities for attackers.
MFA Helps Protect Remote Access
Strong authentication can prevent stolen passwords from becoming immediate access keys.
Monitoring Completes the Defense
A secure login can still be followed by malicious activity.
Configuration Changes Matter
Unexpected IP, password, alarm, or shutdown changes should be treated as high-priority events.
Operators Need Reliable Visibility
Security is not only about preventing commands.
Detection Must Include Physical Consequences
Cybersecurity teams need to understand what a digital change means for pumps, valves, alarms, and treatment processes.
Water Utilities Are Unusual Targets
They may not possess valuable intellectual property, but they control essential public services.
Critical Infrastructure Has Strategic Value
Disruption can create economic, political, and public-safety consequences.
Nation-State Activity Raises the Stakes
A low-level intrusion can potentially become part of a much larger strategic campaign.
Attackers Do Not Need Perfect Exploits
Sometimes they only need defenders to leave a door open.
Exposure Reduction Is Preventive Security
The best incident response is sometimes preventing the incident entirely.
Internet Scanning Should Be Routine
External exposure should be checked continuously rather than once a year.
Shodan and Censys Can Be Defensive Tools
The same visibility attackers have can help defenders understand their exposure.
Open Ports Require Context
An open service is a clue, not automatic evidence of compromise.
Asset Inventories Must Match Reality
If security teams cannot reconcile discovered assets with documented infrastructure, the inventory is incomplete.
Legacy Industrial Systems Need Special Attention
Older equipment may lack modern authentication and security features.
Security Teams Need OT Expertise
Traditional IT security knowledge alone may not be enough to safely manage industrial environments.
IT and OT Teams Must Cooperate
Cybersecurity decisions can affect physical processes.
A Security Change Can Become an Operational Event
Industrial defenders must consider safety before making disruptive changes.
Backup Plans Matter
Organizations need tested recovery procedures for both digital and physical operations.
Incident Response Should Include Operators
Cybersecurity personnel should know who controls the physical process during an incident.
Password Changes Are Not Always Enough
If attackers have established persistence, changing one credential may not remove the threat.
Network Architecture Is More Powerful Than a Single Product
No firewall, VPN, or MFA solution can compensate for a fundamentally exposed architecture.
Security Needs Continuous Improvement
Threats change, personnel change, equipment changes, and infrastructure changes.
Critical Infrastructure Cannot Depend on Hope
The absence of a previous incident does not prove that a system is safe.
The Internet Should Never Be the Default Trust Boundary
Industrial equipment deserves another layer of protection.
CISA’s Message Is Ultimately Simple
Know what is exposed, understand why it is exposed, and eliminate unnecessary exposure.
The Attackers Are Already Looking
Organizations should assume that publicly reachable industrial systems will eventually be discovered.
The Real Race Is Between Discovery and Exploitation
Defenders need to find weaknesses before adversaries do.
The Water Sector Should Treat This as a Wake-Up Call
The cost of correcting exposure today is almost always lower than the cost of recovering from a disruptive intrusion tomorrow.
✅ Internet-Exposed PLCs Can Create Serious Risk
The central technical claim is sound. Directly exposing industrial controllers to the internet can significantly increase the attack surface, particularly when authentication, segmentation, and access controls are weak.
✅ Secure Gateways Are a Recommended Defensive Measure
Routing necessary remote access through controlled gateways, firewalls, VPNs, or comparable security infrastructure is consistent with established industrial cybersecurity practice.
✅ An Open Industrial Port Does Not Automatically Mean a Breach
This distinction is important. A publicly reachable Modbus, DNP3, EtherNet/IP, or other industrial service demonstrates exposure, but additional evidence is required to establish that an attacker actually compromised the device.
⚠️ Attribution to Iran Should Be Treated Carefully
The article identifies Iran as the suspected actor behind much of the activity while noting that officials have not formally attributed all activity. That distinction matters. Suspected attribution should not be presented as definitive attribution without stronger official evidence.
⚠️ The Broader Nation-State Context Needs Nuance
References to campaigns involving China- or Russia-linked actors illustrate a wider critical-infrastructure threat, but individual campaigns have different evidence, objectives, and levels of attribution. They should not automatically be treated as part of one coordinated operation.
Prediction
(+1) Water Utilities Will Accelerate Internet Exposure Audits
The July incidents are likely to push more utilities toward continuous external attack-surface monitoring. Organizations that previously performed occasional security assessments may begin checking internet exposure more frequently.
(+1) Remote Access Architecture Will Improve
Utilities are likely to replace direct PLC connectivity with centralized gateways, VPNs, stronger authentication, and segmented operational networks.
(+1) OT Security Will Receive More Executive Attention
Cybersecurity issues involving industrial equipment become much harder to ignore when they can affect physical infrastructure and public services.
(+1) External Attack-Surface Management Will Become Routine
The ability to see what an attacker can see will increasingly become a standard component of critical-infrastructure security programs.
(-1) Attackers Will Continue Searching for Forgotten Systems
As organizations secure their most visible infrastructure, adversaries are likely to look for smaller utilities, legacy equipment, unmanaged cellular connections, and neglected remote-access systems.
(-1) Legacy Infrastructure Will Remain the Weakest Link
Replacing old PLCs, HMIs, RTUs, and networking equipment can be expensive and operationally complicated, meaning some organizations will continue carrying inherited security risks.
The Bigger Warning Behind the Attacks
Security Starts Before the Breach
The most powerful message from CISA’s warning is that organizations do not need to wait for an intrusion to begin improving their defenses.
They can start by asking what the internet can see right now.
Exposure Is a Choice
If a PLC does not need to be publicly accessible, it should not be.
If remote access is necessary, it should be controlled.
If credentials are shared or still set to defaults, they should be replaced.
If monitoring does not detect unusual configuration changes, it needs improvement.
The Next Incident Does Not Have to Be Yours
The July 2026 attacks demonstrate how quickly a seemingly minor configuration decision can cross the boundary between cybersecurity and physical safety.
For water and wastewater operators, the lesson is especially clear: find the exposed systems, secure the necessary connections, remove the unnecessary ones, and continuously verify that the defenses are still working.
The attackers are already scanning the internet.
The question is whether defenders will discover their own exposed infrastructure first.
▶️ Related Video (66% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
