The computers that automate water treatment systems across the country were built for durability, not for an internet-connected world. Many still accomplish their fundamental function, but as cyberattacks on the sector mounted this summer, water industry officials say those aging systems, especially internet-exposed operational technology and programmable logic controllers, remain among the easiest ways for adversaries to break in.

Tom Dobbins, executive director of the Water Information Sharing and Analysis Center or WaterISAC, told CyberScoop the sector’s biggest ongoing weaknesses include exposed OT, vulnerable PLCs, insecure connections through integrators and poor cyber hygiene at smaller utilities, which have pushed the center to make threat sharing faster across the sector.

“We have been under attack, and our enemies, the threat actors, are stepping up their activity as the U.S. is involved in a number of conflicts around the world,” Dobbins said.

That includes not only threats from Iran, the nation the U.S. government reportedly believes is behind this summer’s water facility attacks, but also China and Russia, he said.

WaterISAC is announcing a partnership with Cyware Wednesday to use its threat intelligence platform, selecting the company in part because of its existing relationships with other industry ISACs, Dobbins said. The ISAC already has a partnership with the National Rural Water Association to serve 20,000 of the water sector’s smallest utilities, and Dobbins said Cyware would help its analysts further.

It’s a sector that faces myriad challenges, seen by many as further behind on protecting its systems due to financial and technological constraints.

“OT systems that are exposed to the internet are a major challenge, and many of these systems that are older generation need to be not accessible to the internet,” Dobbins said.

Furthermore, programmable logic controllers (PLCs) are “obviously” a “vulnerability point,” he said. 

Those two vulnerabilities were the ones most commonly linked to this summer’s attacks.

Across the sector, PLCs have been the “main point of entry” for hackers, in part because they date back to a “simpler, gentler time,” Dobbins said.

“A lot of the equipment was developed pre-cyber threats and activities,” he said. “The equipment, it’s still valuable, it still is operational, so there’s not a huge reason for or incentive for utilities to upgrade it.”

President Donald Trump has disputed the notion that Iran was behind this summer’s attacks, despite alerts from the Cybersecurity and Infrastructure Security Agency.

“Let’s put it this way: I saw a recent CISA release that pointed to Iran as threat actors, and I know that the president kind of implied that it was not Iran, but I’ll say that CISA maybe is more expert in this area than maybe the president,” Dobbins said. “The president may not have been fully briefed when he made that comment.”

But CISA has also warned of potential threats from Russia and China, he said.

Two other sources of vulnerability for the sector are external — integrators — and internal — employees.

“If those integrators are working and they have a connection into an OT system that’s not managed discretely, then a threat actor can come in through an integrator and get into a system,” he said. 

Then there’s someone “who’s actually a good employee who’s tried to do the right thing and opens an email that has a malicious link in it, so they become subject to a phishing attack,” Dobbins said.

At smaller utilities, it can be difficult to keep up with basic cyber hygiene as well, he said: changing passwords, implementing multifactor authentication.

One way that Cyware might be able to help is by leveraging its relationships with other ISACs, said Tom Stockmeyer, managing director of government and critical infrastructure at Cyware.

“We’re thrilled to add water to the portfolio and start enabling cross-sector sharing,” he said.

The post WaterISAC reckons with range of threats after summer of cyberattacks appeared first on CyberScoop.

Nearly two of every 10 U.S. water and wastewater organizations have identity data actively exposed from infostealers harvesting their credentials, according to research published Tuesday.

The study from identity risk firm SpyCloud follows months of reports about a wave of cyberattacks hitting targets in the sector, which U.S. government officials suspect are tied to Iran.

The company built a database of 66,845 Environmental Protection Agency-registered systems, examined internet domains and ultimately analyzed 10,000 organizations, finding that 1,787 showed active infostealer exposure.

In one case, a single infected device at a smart meter technology provider that SpyCloud didn’t name contained saved logins linked to roughly 167 different U.S. utility metering tenants — meaning that one exposure opened the door to many more. 

That “cascading supply chain exposure” was one of the biggest findings of the report that SpyCloud shared exclusively with CyberScoop, said Jason Lancaster, chief investigations officer at the cyber firm, along with the quantitative approach” to measure exposure overall.

“We talk about it a lot,” Lancaster said of the exponential risk that one exposure can present. “There’s examples here and there, but that was a standout example of, here’s a tangible thing that is an exposure right now.”

Generally, “Infostealer exposure means the attacker isn’t guessing anymore, they’ve got legitimate points of entry,” Lancaster said. “In the investigations I’ve worked, that log data usually contains stolen session cookies, credentials, and autofill info pulled straight off the infected device. That’s enough to walk right past [multifactor authentication] by hijacking an already-authenticated session, log into corporate email or VPNs without raising a single alert, and sit there quietly for weeks while they map out the network.”

Still, the study had limitations. It doesn’t address what apparently led to the cyberattacks that unfolded in Minnesota and elsewhere this summer: internet-exposed programmable logic controllers.

It’s “important to note that our research did not focus on OT devices which run the most critical processes within these utilities, and any exposure we cite herein should not be interpreted as exposure of specific OT devices,” the report said. It did, however, find that 258 of the 1,787 organizations with active infostealer exposure carried credentials to operational technology or remote-access systems.

Some of the report’s conclusions were about the limitations of the data itself.

“Exposure concentrated in larger operators and in the vendor supply chain; small utilities were largely underrepresented,” SpyCloud said. “That’s a pattern in the data, not a claim that every water system nationwide carries this risk — and it measures identity exposure, not confirmed intrusion.”

It’s the first study of its kind that SpyCloud has done for a specific industry, so the company doesn’t have comparisons to other industries, Lancaster said. SpyCloud has begun a responsible disclosure process for those affected within its report, he said, beginning with a briefing for the Cybersecurity and Infrastructure Security Agency.

“It’s important to remember, infostealer logs aren’t the end of an incident — they are often the beginning,” Lancaster said. “Access brokers sell these logs specifically because ransomware crews and other fraudsters want exactly this kind of entry point. So, the real question isn’t whether the exposure is dangerous. It’s how much time you have before someone weaponizes that stolen data against you.”

The post Another worry for water systems: infostealer exposure appeared first on CyberScoop.

Hackers are targeting water, food, energy, chemical, manufacturing and commercial facilities by taking aim at Siemens S7 Series programmable logic controllers (PLCs) and making use of artificial intelligence in the attacks, U.S. government agencies warned Wednesday.

It’s the latest government warning about attacks on critical infrastructure as the United States wages war against Iran, which the government blamed for a recent campaign against water and wastewater systems— but doesn’t mention in Wednesday’s alert. 

The National Security Agency didn’t immediately respond to a request for comment about who was behind the attacks on the PLCs, which are used to control manufacturing processes.

The agencies said the attacks were an “active threat,” rather than a theoretical one. The attacks could disrupt critical industrial processes, cause safety incidents or lead to the compromise of sensitive data.

Wednesday’s alert from the NSA, Cybersecurity and Infrastructure Security Agency, FBI, Energy Department and Environmental Protection Agency makes special note of the hackers using AI-generated exploitation scripts in the attacks.

“Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools,” the alert states. “In addition, AI enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures. Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use AI-generated scripts to act on that information.”

A former top CISA official, Michael Garcia, thought that it was a first for the agency in one of its cybersecurity advisories (CSAs) about operational technology (OT).

“It is the first alert I have seen where CISA is saying in a CSA that a malicious actor is using AI scripts to target OT systems,” Garcia, now vice president of the cybersecurity practice at Monument Policy Advocacy, said on LinkedIn. But the advisory doesn’t recommend using AI in response, instead focusing on well-known, traditional defensive measures, he added.

Frenos, an OT penetration testing company, found another element of the alert troubling: The method by which the attackers could use the approach beyond Siemens-made PLCs.

“Siemens S7 is the subject here, but the exposure pattern is not brand specific,” Brian Proctor, CEO of the company, said in an email. “An adversary who has mapped your data blocks understands your process. They know what normal looks like, which means they know what an operator would fail to notice.”

The AI-generated scripts are disguised as legitimate monitoring tools, the advisory said of the hackers behind them.

“The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected,” the advisory reads.

Siemens said it was “aware” of the alert and “is coordinating closely with CISA.”

“This advisory does not describe new vulnerabilities within the S7 Series programmable logic controllers (PLC). Instead, this reflects threat actors employing new techniques to exploit potential misconfigurations,” the company continued, noting a security bulletin it issued last month.

“Siemens will provide updates around this issue to potentially affected customers through our ProductCERT team,” it said. “At this point in time, we have not identified increased attack levels or unknown vulnerabilities in Siemens ICS products.”

Updated 8/20/2026: to include Siemens comment.

The post AI-fueled attacks pose ‘active threat’ to water, other sectors, U.S. agencies warn appeared first on CyberScoop.