Iran-Linked CyberAv3ngers Hit 30+ US Water Systems With an Unpatchable PLC Flaw — Boil-Water Notices Issued, 7 States on Alert

On the morning of 27 July 2026, operators at more than 30 community water utilities across Minnesota arrived at their control panels to find themselves locked out. Passwords had been changed. IP addresses had been altered. In cities including Plymouth, South St. Paul, Maple Plain, and Braham, the automated systems that keep clean water flowing had been silently hijacked — forcing manual operations, triggering boil-water notices, and exposing one of the most uncomfortable truths in critical infrastructure security: there are industrial controllers running right now, on the open internet, with a flaw that cannot be patched.

By July 30, the Cybersecurity and Infrastructure Security Agency (CISA) had issued advisory AA26-097A, the FBI had published a flash alert, and incidents had been reported across seven U.S. states. Security researchers at Tenable pointed to Iran-linked hacktivist group CyberAv3ngers as the likely culprit — and the flaw at the center of the attack, CVE-2021-22681, has no software fix available, now or ever.

What Happened: A Coordinated Strike on Critical Infrastructure

The attacks began on Sunday, 27 July 2026. Threat actors gained access to internet-exposed programmable logic controllers (PLCs) at water treatment and distribution facilities. They then executed a simple but brutally effective playbook:

1. Changed operator passwords — locking out legitimate staff from the control interface.
2. Modified IP addresses — severing remote access and complicating recovery.
3. Disrupted automated control functions — forcing facilities to switch to manual operation, a labour-intensive fallback that strains small utilities.

At least one plant went fully offline. Residents in affected cities received boil-water advisories. Drinking water remained safe overall — operators caught the disruption before any chemical dosing was affected — but the incident exposed exactly how thin the margin of safety is when OT systems are left internet-facing and unprotected.

By Monday the 28th, incidents had been reported to the FBI from utilities in Minnesota, Michigan, and five other states. The scale and coordination pointed unmistakably to a deliberate, targeted campaign rather than opportunistic scanning.

The Vulnerability That Cannot Be Fixed: CVE-2021-22681

At the heart of the attack is CVE-2021-22681, a vulnerability in Rockwell Automation Allen-Bradley PLCs — including the widely deployed CompactLogix and Micro850 series. The flaw is architectural: Rockwell’s Studio 5000 Logix Designer engineering software uses a shared cryptographic key embedded in the software itself. That key cannot be changed without breaking the entire engineering toolchain.

What this means in practice: any attacker who obtains that key — and it has been extracted and published — can authenticate to any Allen-Bradley PLC as a trusted engineering workstation. There is no software update that addresses this because the fix would require a hardware-level redesign and replacement of deployed devices.

Rockwell’s advisory recommends:

• Never connect PLCs directly to the internet.
• Enforce network segmentation between OT and IT networks.
• Use CIP Security (for newer hardware that supports it).
• Enable device-level authentication where available.

Beyond Rockwell hardware, the attackers also targeted Schneider Electric Modicon M340 and Siemens S7-1200 PLCs at some facilities, accessing them through cellular modems that vendors or system integrators had installed for remote maintenance — devices that were often left with default credentials and no access restrictions.

Who Is CyberAv3ngers?

Tenable’s Research Special Operations team assessed, with moderate confidence, that CyberAv3ngers — an Iran-linked hacktivist group — is behind the Minnesota attacks. The attribution is not yet officially confirmed by any U.S. government agency, but the group’s operational fingerprints are consistent: small water utilities, internet-connected cellular OT equipment, and timing aligned with the group’s documented campaign phases.

Phase	Timeline	Targets / TTP
Phase 1–2	2020–2023	Israeli-made PLCs in U.S. water facilities; opportunistic defacement
Phase 3	2024–early 2026	Broader ICS targeting; credential stuffing; credential-harvesting via vendor portals
Phase 4 (current)	March 2026–present	CVE-2021-22681 exploitation; targeting small utilities with cellular-connected OT

The group is assessed to be linked to the Islamic Revolutionary Guard Corps (IRGC) and has previously claimed responsibility for attacks on water facilities in Pennsylvania and Texas. A separate group, Handala, has also been cited as a possible participant in the July 2026 wave, though evidence is less definitive.

Why This Matters Beyond the United States

Indian critical infrastructure faces an identical exposure profile. Across India’s water distribution systems, power substations, and manufacturing plants, legacy PLCs are routinely connected to the internet via cellular modems for remote monitoring — often installed by system integrators who prioritise convenience over security. Default credentials are common. Network segmentation between OT and IT is the exception, not the rule.

CERT-In has warned repeatedly about OT/ICS vulnerabilities, but the pace of remediation in the water and power sectors has been slow. If CyberAv3ngers or a similar group decides to target Indian utilities, the attack surface is just as large and the defences just as thin. The Minnesota incidents are not a distant American problem — they are a preview of what happens when OT security is deferred long enough.

This is also not a problem exclusive to government utilities. Private industrial facilities — chemical plants, food processing, pharmaceuticals — run the same PLCs, the same cellular modems, and the same default configurations. A ransomware group targeting production uptime faces the same easy entry point.

What You Should Do Right Now

Sanjay’s practitioner-level guidance for OT-adjacent organisations, shaped by 30 years of working with enterprise and industrial networks:

Immediate (This Week)

• Audit internet-facing OT. Run a Shodan or Censys query against your IP ranges for exposed PLC interfaces, HMIs, and remote management ports. If you find them, disconnect them immediately.
• Rotate all PLC and HMI credentials. Change every default password on every controller. Yes, all of them. This week.
• Disable cellular modem remote access unless actively in use, and implement IP allowlisting for the engineering workstation IPs that legitimately need access.

Short-Term (30–90 Days)

• Deploy a DMZ or OT jump server for all remote access to industrial systems. No PLC should be directly reachable from the internet — route all access through an authenticated VPN gateway.
• Implement network segmentation. OT networks must be isolated from IT and corporate networks, with only explicitly whitelisted traffic allowed to cross the boundary. A FortiGate with VDOM-based segmentation or a dedicated OT firewall is the right tool here.
• Enable alerting on PLC configuration changes. Rockwell, Siemens, and Schneider all have SIEM-integrable logging. Any password change or IP modification on a PLC should trigger an immediate alert.
• Inventory CVE-2021-22681 exposure. If you run Allen-Bradley PLCs, assume the key is compromised and compensate with network controls — CIP Security where the hardware supports it, strict firewall rules where it doesn’t.

Strategic

• Zero-trust for OT is not optional. Every device, every operator, every connection must be authenticated and authorised. This applies to OT just as much as to cloud workloads.
• Conduct an OT/ICS security assessment. Most organisations with operational technology have never had a dedicated OT security review. The gap between assumed and actual exposure is almost always alarming.

For reference, our analysis of how attackers chain CISA-flagged CVEs across critical infrastructure illustrates why a single unpatched device on an OT network can become the entry point for a full compromise. Similarly, the Cisco FMC hard-coded credential zero-day we covered recently shares the same root cause pattern: credentials embedded in firmware, impossible to patch without hardware replacement, exploited in the wild.

Frequently Asked Questions

Can CVE-2021-22681 actually be patched?

No. Rockwell Automation has confirmed that this vulnerability is architectural — it stems from a shared cryptographic key embedded in Studio 5000 Logix Designer engineering software that applies globally to all Allen-Bradley PLCs. A software update cannot fix it. The only mitigation is network-level isolation: never allow untrusted network access to an exposed PLC, and deploy CIP Security where supported by newer hardware versions.

My water utility or industrial facility uses these PLCs. What’s the risk?

If your PLCs are internet-facing, reachable through an unsecured cellular modem, or accessible without strong authentication, your risk is high. CyberAv3ngers has demonstrated the ability to target dozens of facilities simultaneously in a coordinated wave. The attack requires no custom malware — just network access and the compromised engineering key. Disconnect, segment, and audit immediately.

Is India at risk from similar attacks on water and power systems?

Yes. India’s water utilities, electricity distribution companies (DISCOMs), and manufacturing sector make extensive use of the same Rockwell, Siemens, and Schneider PLC families. CERT-In and the NCIIPC have issued OT security advisories, but adoption of compensating controls remains inconsistent. The threat is real, the attacker playbook is now public, and the window to act is shrinking.

Who else besides CyberAv3ngers should I be worried about in this space?

Nation-state APTs with documented OT/ICS attack capabilities include Russia’s Sandworm (responsible for Ukraine power grid attacks), China’s Volt Typhoon (pre-positioning in U.S. critical infrastructure for potential future disruption), and North Korea’s Lazarus Group. Criminal ransomware groups including ALPHV/BlackCat and LockBit have also targeted industrial environments. The Minnesota attacks are a reminder that even mid-tier hacktivist groups now have the tools and knowledge to cause real operational disruption.

---