Iranian threat actors' Water and Wastewater Systems PLC targeting campaign
Campaign
Summary
Hide ▲
Show ▼
A campaign tied to Iranian threat actors targeted over 100 internet-exposed water systems in July 2026, signaling a broad operation against critical OT environments. The activity focused on Water and Wastewater Systems (WWS) and frequently used PLCs connected directly to cellular modems as the exposure path. The operation sought to cause disruption to OT systems, but it did not achieve significant disruption. The event prompted updated sector guidance to reduce internet exposure and harden remote access.
Related Happenings
Siemens S7 PLC AI-assisted exploitation campaign targeting critical infrastructure
Campaign
H score17
First: 19.08.2026 20:50
Last: 19.08.2026 20:50
Sources 1
About this happening:
The U.S. government warned of an active threat using AI-generated exploit scripts against Siemens S7 Series PLCs in U.S. critical infrastructure. The campaign...
Siemens S7 PLC AI-assisted exploitation campaign targeting critical infrastructure
CampaignAbout this happening: The U.S. government warned of an active threat using AI-generated exploit scripts against Siemens S7 Series PLCs in U.S. critical infrastructure. The campaign...
Russian Electrum Poland energy-sector destructive campaign
Campaign
H score43
First: 11.08.2026 02:07
Last: 11.08.2026 02:07
Sources 1
About this happening:
The Russian Electrum-linked December 29, 2025 operation expanded into a multi-site destructive campaign against Poland's energy sector, targeting 30 wind and solar i...
Russian Electrum Poland energy-sector destructive campaign
CampaignAbout this happening: The Russian Electrum-linked December 29, 2025 operation expanded into a multi-site destructive campaign against Poland's energy sector, targeting 30 wind and solar i...
Minnesota water OT exposed PLC coordinated cyberattack campaign
Campaign
H score65
First: 31.07.2026 19:49
Last: 31.07.2026 19:49
Sources 1
About this happening:
A coordinated cyberattack is disrupting more than 30 Minnesota community water systems, forcing some operators onto manual operations and increasing the risk of wider...
Minnesota water OT exposed PLC coordinated cyberattack campaign
CampaignAbout this happening: A coordinated cyberattack is disrupting more than 30 Minnesota community water systems, forcing some operators onto manual operations and increasing the risk of wider...
U.S. agencies expand PLC-targeting warning and guidance
Public Sector Action
H score22
First: 29.07.2026 16:48
Last: 29.07.2026 16:48
Sources 1
About this happening:
U.S. agencies and CISA expanded a warning about Iranian-affiliated actors targeting internet-facing programmable logic controllers, raising immediate operational risk...
U.S. agencies expand PLC-targeting warning and guidance
Public Sector ActionAbout this happening: U.S. agencies and CISA expanded a warning about Iranian-affiliated actors targeting internet-facing programmable logic controllers, raising immediate operational risk...
Automatic tank gauge (ATG) systems ongoing attacks
Exploitation Wave
H score25
First: 05.06.2026 17:50
Last: 05.06.2026 17:50
Sources 1
About this happening:
Over 900 internet-exposed ATG systems across the United States are being targeted in ongoing attacks, creating risk of alert tampering, fuel or chemical leaks, and...
Automatic tank gauge (ATG) systems ongoing attacks
Exploitation WaveAbout this happening: Over 900 internet-exposed ATG systems across the United States are being targeted in ongoing attacks, creating risk of alert tampering, fuel or chemical leaks, and...
Timeline
-
26.08.2026 14:29 2 articles · 1h ago
Iranian threat actors' Water and Wastewater Systems PLC targeting campaign
Initial DisclosureIn July 2026, CISA detected malicious activity against over 100 WWS systems exposed to the internet. The common exposure path was PLCs reached through cellular modems.
Show sources
- CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks — www.securityweek.com — 26.08.2026 14:29
- CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks — www.securityweek.com — 26.08.2026 14:29