Nation-State Actors Are Actively Exploiting Water Utility OT Systems — And the Window for Complacency Has Closed
Water and wastewater utilities in the United States, Israel, and allied states are under sustained, confirmed nation-state cyber pressure targeting the operational technology (OT) that controls physical processes — pumps, chemical dosing systems, valves, and alarms. This is no longer a theoretical or emerging risk. Multi-agency U.S. federal guidance from CISA, the FBI, NSA, and EPA, alongside consolidated threat-intelligence reporting, confirms that Iranian-affiliated actors and other state-linked groups have moved well beyond reconnaissance into active manipulation of internet-facing control systems at civilian water facilities.
The operational picture is specific. Iranian IRGC-linked actors, including groups attributed to CyberAv3ngers, have compromised internet-exposed programmable logic controllers (PLCs) and human-machine interfaces (HMIs) at U.S. critical infrastructure including water and wastewater systems. CISA documented compromises of internet-exposed PLCs — particularly Unitronics-brand devices — at multiple U.S. critical-infrastructure facilities across several sectors, according to agency advisories; public descriptions refer to "multiple" or "numerous" affected utilities rather than any single verified aggregate count, and the actual exposure surface is likely broader than confirmed cases reflect given the acknowledged gap in OT visibility at many utilities. One publicly documented example: the Aliquippa, Pennsylvania municipal water authority, where CyberAv3ngers-linked actors compromised an internet-exposed Unitronics PLC in late 2023, triggering a manual-override response and drawing federal attention to the sector's systemic exposure.
Separately, Iranian actors have conducted cyberattacks against Israeli water and wastewater control systems, a pattern that has remained elevated in the current threat environment. Israel's National Cyber Directorate has publicly acknowledged sustained Iranian cyber pressure on Israeli critical infrastructure. Available open-source reporting documents increased Iranian cyber activity against Israeli targets, though granular month-by-month incident counts have not been independently confirmed by major wire services or official agency publications at the time of this writing; readers should treat any specific figures circulating in secondary sources with caution until corroborated by primary Israeli government or major-wire reporting. What is not in dispute is the strategic intent: Israeli officials have publicly stated there is no ceasefire in cyberspace, and the critical-infrastructure sector — including water — remains an explicitly targeted domain.
For utility security directors and GSOC teams, the structural vulnerabilities driving this exposure are well-documented and disturbingly consistent across facilities. Consolidated threat reporting identifies the same converging weaknesses at compromised and at-risk sites: internet-facing HMIs and PLCs with no network-layer protection; default or shared operator credentials that have never been rotated; legacy devices running unsupported firmware; remote-access tools exposed without multi-factor authentication; and poor or nonexistent segmentation between corporate IT networks and OT environments. These are not sophisticated zero-day exploitation chains. Federal advisories describe water-sector OT as effectively low-hanging fruit for state actors precisely because the entry barriers are low and the downstream signaling value — disruption of civilian services, public-health anxiety, retaliation propaganda — is high. The strategic logic for Iranian actors in particular is visibility: compromising a municipal water system creates a coercive, newsworthy event even when physical damage is limited. PRC-linked actors, by contrast, are assessed to pursue quieter persistence — pre-positioning within water-sector IT/OT networks for potential activation during a future geopolitical crisis. Both threat profiles are active simultaneously.
The consequences that security teams should plan against are not limited to large-scale catastrophic failure. Analysts reviewing recent incidents stress that partial or temporary OT manipulation — misoperating pumps or valves, altering chemical dosing parameters, triggering false alarms, or forcing manual overrides — is sufficient to cause local service disruption, unsafe operations, and public panic without achieving anything resembling a kinetic attack. For NGO and humanitarian duty-of-care leads operating clinics, shelters, or IDP support sites in urban areas, even a short-duration disruption to municipal water supply or wastewater treatment carries direct public-health implications for the populations they serve. Executive protection and travel-risk teams should likewise recognize that degraded potable water availability or wastewater management failures can rapidly alter operating conditions for traveling personnel and dependents in affected metros, warranting inclusion in site-specific contingency planning rather than treatment as a background IT concern.
The appropriate response framework for security leads and GSOC teams at this moment is not reactive crisis management — it is structured baseline hardening combined with accelerated detection capability. Federal joint advisories are explicit: remove HMIs and PLCs from direct internet exposure, enforce unique strong credentials and account management across all OT operator accounts, apply multi-factor authentication to any remote-access path into OT environments, and establish continuous monitoring for anomalous commands or unexpected process changes. Equally important is the IT/OT segmentation audit: many utilities that believe their control systems are isolated have found, under examination, that pathways exist through shared business-network infrastructure or legacy remote-support connections. Where resources are constrained — and in this sector, they chronically are — prioritizing visibility into internet-facing OT assets is the highest-return first step, because threat actors are selecting targets through exactly that lens.
Geospatial-intelligence and OSINT platforms that continuously index internet-exposed industrial control system interfaces can provide utility security teams with an outside-in view of their own attack surface — the same view a nation-state reconnaissance unit would use — enabling proactive remediation before exploitation occurs. Layering that asset-exposure data against threat-actor activity patterns and geographic incident clustering gives GSOC teams the situational context to prioritize response and communicate risk to leadership with evidence rather than conjecture.
Sources
- CISA — Water and Wastewater Systems Sector: Critical Infrastructure Security and Resilience
- CISA Alert AA23-335A — Exploitation of Unitronics PLCs Used in Water and Wastewater Systems
- CISA / FBI / NSA / EPA — Joint Advisory: ICS/SCADA Cybersecurity Best Practices for the Water Sector
- FBI Pittsburgh Field Office — Statement on Aliquippa Water Authority Cyberattack (November 2023)
- Israel National Cyber Directorate — Official Publications and Threat Reporting
- CISA — Known Exploited Vulnerabilities Catalog: Unitronics Vision Series
This article is for situational awareness only and is not a risk advisory.