Close Menu
    Cyber Threat Intelligence

    Systemic Vulnerabilities in Critical Infrastructure: Threat Intelligence Analysis of Multi-State Cyber Campaign Targeting Water and Wastewater Operational Technology

    cyber security threatBy Updated:No Comments19 Mins Read
    State Cyber Campaign Targeting Water and Wastewater Operational Technology1

    Executive Threat Overview

    A series of coordinated cyber intrusions targeting the United States Water and Wastewater Systems (WWS) sector has highlighted structural vulnerabilities in public critical infrastructure1. Initiated on July 26, 2026, and officially confirmed via a joint Public Service Announcement (Alert I-073026-PSA) by the Federal Bureau of Investigation (FBI) and the Environmental Protection Agency (EPA) on July 30, 2026, malicious cyber actors engaged in widespread, low-complexity, high-impact exploitation of internet-facing Operational Technology (OT) assets1. The targeted assets primarily comprise Rockwell Automation/Allen-Bradley Programmable Logic Controllers (PLCs), specifically the MicroLogix 1100 and 1400 series4.

    The multi-state campaign began with intrusions compromising more than 30 municipal water utilities across Minnesota, including localized operational shutdowns in municipalities such as Braham, Plymouth, Maple Plain, and South St. Paul2. Within days, the scope expanded to utilities across at least seven U.S. states, including Michigan and subsequently reached 12 or more states, including Georgia, South Dakota, and New Jersey1.

    The primary objective observed in these intrusions is the direct manipulation and lock-out of industrial control systems4. Threat actors leveraged direct industrial protocol connections to alter IP network configurations, reset administrative access passwords, and upload tampered ladder logic project files4. These actions induced simultaneous “Loss of View” and “Loss of Control” conditions for operators, forcing facilities to disconnect automated control systems and revert to manual physical operations1. Reported physical disruptions included severe pressure drops, well pump shutdowns, lift station overrides, boil-water notices, and localized flooding1. Systemic drops in hydraulic pressure introduce severe public health risks, as negative pressure differentials allow untreated surrounding groundwater and pathogens to ingress into municipal drinking water distribution networks7.

    This operational disruption reflects an ongoing escalation in state-sponsored and affiliated adversary interest in critical infrastructure OT assets4. Historical precedent was established between October 2023 and early 2024, when the Iranian Islamic Revolutionary Guard Corps (IRGC)-affiliated actor operating under the persona “CyberAv3ngers” systematically targeted Israeli-manufactured Unitronics Vision Series PLCs with Human-Machine Interfaces (HMIs) across the WWS sector4. While official federal advisories for the July 2026 campaign maintain a broad attribution to “malicious cyber actors,” the tactical alignment with opportunistic mass-exploitation of internet-exposed industrial devices demonstrates a persistent operational doctrine aimed at sowing public distrust and disrupting vital municipal services1.

    Comparative Threat Actor TTPs and Tactical Evolution

    The 2026 campaign targeting Rockwell Automation controllers represents a tactical shift when contrasted with the late 2023 CyberAv3ngers campaign targeting Unitronics hardware2. The initial 2023 attacks were characterized by automated scanning for TCP port 20256, the default port for Unitronics PCOM/TCP protocol communication and the systematic exploitation of unchanged default administrative credentials (such as password 1111)4. Upon gaining access, adversaries deployed defacement screens on integrated HMIs and altered physical operational parameters, such as taking control of pressure booster stations at facilities like the Municipal Water Authority of Aliquippa (MWAA) in Pennsylvania4.

    Between 2024 and 2026, Iranian-affiliated threat vectors transitioned toward more sophisticated command-and-control (C2) frameworks and platform-agnostic techniques12. By mid-2024, security research identified the deployment of “IOCONTROL,” a custom Linux-based malware framework engineered to communicate over encrypted MQTT-over-TLS channels to interact directly with routers, PLCs, and field gateways. Concurrently, threat actors expanded their target set from specialized hardware (Unitronics) to market-dominant industrial automation ecosystems, specifically Rockwell Automation’s Logix and MicroLogix controller families.

    By March 2026, joint multi-agency advisories (including CISA AA26-097A) warned of threat actors actively weaponizing unauthenticated protocol mechanisms and critical authentication bypass vulnerabilities, such as CVE-2021-22681 in Rockwell Logix controllers, alongside direct industrial protocol manipulation9.

    Operational Characteristic2023 Unitronics Campaign (CyberAv3ngers)2026 MicroLogix / Multi-Vendor Campaign
    Primary Target HardwareUnitronics Vision Series PLCs with embedded HMIs5Rockwell Automation MicroLogix 1100/1400 (Secondary: CompactLogix, Micro850, Siemens, Schneider)1
    Targeted Ports & ProtocolsTCP Port 20256 (PCOM/TCP Protocol)4TCP Port 44818 (EtherNet/IP Protocol), Modbus TCP2
    Primary Intrusion MechanismDefault credential abuse (1111) on public internet-facing assets2Direct unauthenticated protocol interface connections via cellular modems/public IP exposure1
    Tactical ExecutionHMI graphical defacement, parameter manipulation, localized pump shutdowns4Password resets, IP address reconfigurations, tampered ladder logic file downloads1
    Primary Operational ImpactLocalized Loss of Control, HMI display lock-out, forced manual overrides2Multi-state simultaneous Loss of View/Control, pressure drops, system flooding, boil-water alerts1
    Vendor Mitigation & SoftwareVisiLogic v9.9.00 update enforcing mandatory default password changesPhysical key switch to “RUN”, cellular network APN isolation, network segmentation, EOL replacements1

    The 2026 campaign reflects a low-complexity yet broadly effective tradecraft model2. Adversaries did not rely on zero-day exploits or customized binary payloads2. Instead, they conducted automated reconnaissance using search platforms like Shodan and Censys to catalog internet-exposed industrial interfaces operating on EtherNet/IP (TCP port 44818)5. Once identified, actors initiated standard administrative protocol commands to lock out legitimate operators by changing access credentials, altering system network parameters, and overwriting control logic4. The rapid proliferation across dozens of public water utilities within days indicates the use of automated script suites configured to execute sequence-of-events attacks against exposed port configurations5.

    Technical Analysis of Initial Access and Operational Intrusions

    The initial access phase of the 2026 intrusion campaign relies almost entirely on public network reachability rather than complex initial exploitation vectors5. Municipal water authorities routinely deploy remote telemetry systems to monitor geographically distributed field assets, including distant wellheads, storage reservoirs, chemical booster stations, and sewage lift pumps5. To establish remote connectivity economically, utilities frequently connect field PLCs directly to commercial cellular routers and wireless modems6. When these cellular devices are deployed with static public IPv4 addresses or unmanaged dynamic pools without intermediating firewalls or Virtual Private Networks (VPNs), the physical control interfaces become directly visible to open-source threat intelligence tools and automated internet scanners1.

    Once an adversary identifies an exposed PLC operating on EtherNet/IP (TCP port 44818), the attack sequence unfolds through direct industrial protocol interactions5. Because native industrial protocols lack application-layer encryption and session-level authentication by default, the incoming session is granted administrative access equivalent to a locally connected engineering workstation running vendor programming suites2. The adversary initiates a three-stage manipulation process:

    1. Network Adapter Interface Reconfiguration: The threat actor issues management commands over EtherNet/IP to change the internal network configuration and IP subnet parameters of the controller’s communication interface4. This immediately severs communication between the PLC and the central SCADA master unit, isolating the field controller and forcing a complete “Loss of View” condition for plant operators1.
    2. Administrative Access Lockout: The actor sets or modifies administrative passwords within the device firmware4. On unauthenticated or default-configured devices, this action locks out legitimate field engineers, preventing remote administrative remediation, diagnostic session attachment, or configuration rollbacks over the network4.
    3. Control Logic Tampering and Project Download: The actor initiates an unauthorized download sequence, uploading a modified ladder logic project file directly to the controller’s non-volatile memory4. This modified code alters pump staging sequences, overrides high/low level thresholds, or completely halts execution loops, resulting in immediate physical process failures1.

    Hardware Vulnerability Profiles and Exposure Telemetry

    Empirical internet exposure data underscores the systemic nature of OT vulnerability across public infrastructure6. Telemetry gathered by Forescout’s Vedere Labs following the July 2026 campaign revealed 4,407 Rockwell Automation and Allen-Bradley PLCs globally exposed to the internet on TCP port 4481820. The United States accounted for 2,844 of these devices (64.5% of the global total)20. Crucially, over 70% of these U.S. installations were connected via cellular modems on commercial mobile carrier networks20. In-depth analysis of 22 exposed controllers located directly within municipal jurisdictions that reported active cyber incidents showed that 19 ran firmware susceptible to known legacy vulnerabilities20.

    Hardware Model / FamilyLifecycle StatusProportion of Exposed U.S. AssetsPrimary Communication ProtocolsVulnerability Profile & Operational Risk
    Rockwell MicroLogix 1100End-of-Life (Discontinued April 30, 2022)9~8%6EtherNet/IP (TCP 44818), Modbus TCP, DF12Lacks vendor security patches; susceptible to unauthenticated configuration overwrites and administrative lockout1.
    Rockwell MicroLogix 1400Active / Legacy Support20~50%6EtherNet/IP (TCP 44818), Modbus TCP, DNP35Susceptible to CVE-2017-16740 (buffer overflow in Modbus TCP stack); subject to direct logic downloads20.
    Rockwell CompactLogix 1769Active6~22%6EtherNet/IP (TCP 44818), CIP5Vulnerable to CVE-2021-22681 (critical unpatched authentication bypass, CVSS 9.8).
    Rockwell ControlLogix 5590Active6~8%6EtherNet/IP (TCP 44818), CIP5Vulnerable to CVE-2021-22681; targeted via Studio 5000 project file modification.
    Unitronics Vision SeriesActive5Historical Baseline (2023 Campaign Target)4PCOM/TCP (TCP 20256)10Legacy exposure via default password 1111; addressed via VisiLogic software patch v9.9.002.

    Vulnerability profiling indicates that while CVE-2017-16740 (a nine-year-old buffer overflow vulnerability in MicroLogix 1400 Modbus TCP handling) was present on 86% of the exposed controllers in affected cities, adversary success in the July 2026 campaign did not depend on memory corruption exploits2. Instead, native protocol features provided adequate access to execute logic modifications and setting changes directly5. For higher-capacity industrial platforms like the CompactLogix and ControlLogix families, threat actors exploit CVE-2021-22681. This critical flaw permits unauthenticated remote actors to bypass security mechanisms, interact with controllers via engineering software (such as Studio 5000 Logix Designer), read and write memory addresses, and upload altered execution logic. Because CVE-2021-22681 stems from fundamental protocol architectural design choices within legacy CIP stacks, no vendor software patch exists, requiring strict network isolation and physical controls.

    Physical Process Cascades and MITRE ATT&CK for ICS Alignment

    The physical impact of cyber intrusions on water treatment and distribution processes follows a distinct mechanical sequence2. When an adversary overwrites a PLC’s execution logic or alters network addresses, the field controller loses contact with the SCADA supervisory station4. SCADA alarms trigger, but operators are unable to send control commands or view system status2. At the field level, tampered logic routines force well pump motors to shut down or override lift station pump cycles5.

    In drinking water systems, halting primary booster pumps causes a rapid pressure drop across distribution mains5. When internal pipe pressure drops below surrounding ground pressure, a negative pressure differential occurs7. This differential allows untreated groundwater, surface runoff, and bacterial contaminants to enter drinking water lines through pipe joints and micro-fissures1. Consequently, local authorities are forced to issue boil-water advisories and deploy emergency physical sampling teams5. In wastewater systems, halting lift station pumps causes untreated effluent to back up within wet wells, resulting in localized environmental flooding and sanitary sewer overflows1.

    To standardize threat intelligence reporting across the industrial domain, the tradecraft observed during these intrusions is mapped directly to the MITRE ATT&CK for ICS framework:

    • Insecure Credentials – Default Credentials (T1694.001): Applied during the 2023 campaign to exploit unchanged default passwords (1111) on internet-exposed Unitronics PLCs2.
    • Internet Accessible Device (T0883): Adversaries systematically identified and accessed target assets via direct public IPv4 addressing and cellular gateway routing exposed on TCP port 44818 (EtherNet/IP) and TCP port 20256 (PCOM/TCP)2.
    • Modify Parameter (T0836) and Program Download (T0843): Threat actors executed unauthorized administrative commands to overwrite ladder logic project files, reconfigure IP settings, and change device passwords4.
    • Loss of View (T0829): Reconfiguration of PLC network interfaces severed communication with SCADA polling engines, obscuring operational telemetry including tank levels, system pressures, and pump operational states1.
    • Loss of Availability (T0826) and Loss of Control (T0827): Automated treatment processes were forcibly halted, depriving plant operators of automated control and leading to pump trips, pressure drops, and localized flooding2.
    • Denial of Service (T0814): Communication loss with remote lift stations and wellheads resulted in full operational halts, requiring physical site visits by field technicians to execute hard power cycles and manual overrides2.

    Sectoral Structural Weaknesses and Policy Imperatives

    The concentration of cyber impacts on small and midsize municipal utilities highlights long-standing structural vulnerabilities across the nation’s critical infrastructure4. The U.S. Water and Wastewater Sector is highly decentralized, encompassing approximately 153,000 public drinking water systems and over 16,000 publicly owned wastewater facilities4. While more than 80% of the U.S. population relies on these systems for potable water, the vast majority of utilities operate as municipal departments in small communities with limited capital budgets and minimal dedicated cybersecurity staff2.

    In small municipalities, such as Braham, Minnesota (population ~1,700), public works staff manage physical operations, chemical dosing, and mechanical maintenance simultaneously2. These utilities frequently rely on external system integrators to install control systems, resulting in long-term reliance on default configurations, unmonitored cellular modems, and shared administrative passwords2. System integrators prioritize remote accessibility to reduce on-site maintenance visits, often placing controllers directly on public cellular networks without adequate security controls6.

    Attempts to establish mandatory baseline cybersecurity standards across the sector have faced regulatory and legal friction20. Efforts by the EPA to evaluate cybersecurity programs during routine state-administered sanitary surveys encountered legal challenges from industry associations and state attorneys general, culminating in the withdrawal of the proposed requirements10. Consequently, cybersecurity oversight remains largely voluntary, leaving small utilities dependent on guidance advisories while operating legacy hardware—such as the MicroLogix 1100, which reached End-of-Life status in April 2022—that cannot receive security firmware updates1.

    Strategic Mitigations and Defensive Architecture

    To secure operational technology environments against automated scanning and unauthorized protocol connections, asset owners and operators must implement a layered defense-in-depth architecture1. Mitigating these vulnerabilities requires addressing network exposure, access controls, operational continuity, and asset lifecycle management4.

    Perimeter Hardening and Network Exposure Reduction

    Facilities must immediately disconnect all PLCs, HMIs, and field control equipment from direct internet exposure1. Inbound port forwarding to industrial controllers must be disabled across all perimeter routers and cellular gateways1. For remote telemetry deployments that require cellular connectivity, utilities must transition away from public IP addressing and implement private Access Point Names (APNs), site-to-site VPN tunnels, or Zero Trust Network Access (ZTNA) solutions4. External interface scanning must be conducted routinely to ensure no management ports specifically TCP 44818 (EtherNet/IP), TCP 20256 (PCOM/TCP), TCP 502 (Modbus TCP), or TCP 2222—are reachable from public networks5.

    Logical and Physical Access Safeguards

    Network access to OT assets must be mediated through dedicated Jump Hosts or Remote Access Gateways located within an isolated Industrial DMZ1. All remote administrative connections must require Multi-Factor Authentication (MFA) and centralized session logging4. Unencrypted or unmonitored commercial remote desktop software must be removed from engineering workstations12. Additionally, firewalls and industrial switches must enforce strict Access Control Lists (ACLs) on port 44818, limiting EtherNet/IP traffic exclusively to authorized SCADA servers and engineering workstations1.

    At the device layer, operators should utilize physical hardware protection controls1. On supported platforms, such as Rockwell Logix and MicroLogix controllers, the physical mode key switch must be placed in the “RUN” position4. Moving the key switch to “RUN” physically disables the controller’s capacity to accept remote logic downloads, program changes, or firmware updates over the network4. Key switches should only be moved to “REMOTE” or “PROGRAM” mode during scheduled, monitored maintenance windows, and returned to “RUN” immediately after completion4.

    Operational Continuity and Backup Verification

    Utilities must maintain off-network, verified backups of all active PLC logic project files and HMI configurations1. Operators should regularly perform checksum validations comparing active controller memory against verified offline logic files to detect unauthorized program modifications1. Operations teams must also conduct periodic drills testing their ability to transition facilities to manual operations1. Facilities should ensure field personnel can manage mechanical valve operation, manual pump staging, and chemical dosing safely without automated SCADA systems during extended cybersecurity incidents1.

    Lifecycle Management for Legacy Infrastructure

    Asset owners must maintain a rolling 12-month End-of-Life (EOL) asset inventory to identify legacy hardware operating without vendor software support1. Legacy controllers that can no longer receive firmware updates such as the MicroLogix 1100 must be prioritized for hardware replacement4. If immediate replacement is constrained by capital budgets, compensating controls, including strict physical network isolation, dedicated firewall micro segmentation, and disabled secondary protocols must be enforced until decommissioning can occur4.

    Leveraging Gurucul Security Solutions for OT and ICS Infrastructure

    Addressing the operational technology (OT) vulnerabilities exposed during campaigns targeting water and wastewater utilities requires moving beyond static perimeter firewalls and reactive alert rules21. Advanced security analytics platforms, such as those developed by Gurucul, provide dedicated capabilities engineered to detect, contextualize, and mitigate sophisticated intrusions across hybrid IT, OT, and industrial control environments22.

    Behavioral Anomaly Detection and Machine Learning for OT Protocol Traffic

    Traditional security controls often fail when threat actors use native administrative protocols—such as EtherNet/IP on TCP port 44818 or Modbus TCP on port 502—because incoming traffic appears as legitimate configuration activity2. Gurucul’s Next-Gen SIEM and User and Entity Behavior Analytics (UEBA) incorporate custom machine learning models trained on IoT and OT device telemetry22. Rather than relying strictly on known CVE signatures, the platform establishes dynamic behavioral baselines for all connected entities, including Programmable Logic Controllers (PLCs), Human-Machine Interfaces (HMIs), and cellular telemetry modems22. When an unauthorized host or external IP attempts to issue out-of-sequence commands, reconfigure network parameters, or execute unauthorized ladder logic project downloads, Gurucul flags the anomaly immediately22.

    Identity Threat Detection and Access Analytics (ITDR)

    A primary attack vector observed in municipal intrusions involves exploiting unmanaged remote access links and cellular gateways to alter administrative passwords and lock out legitimate plant operators1. Gurucul’s Identity Threat Detection and Response (ITDR) and Identity Access Analytics continuously evaluate credential usage and session behavior across hybrid networks23. By correlating access rights with historical user activity, the platform identifies dormant account activation, unexpected privilege escalation, and credential abuse across remote engineering tools23. This visibility ensures that compromised credentials or rogue administrative sessions are detected before adversaries can achieve lateral movement or alter controller memory23.

    Automated Incident Orchestration and Noise Reduction

    Small and midsize municipal utilities frequently lack dedicated 24/7 Security Operations Center (SOC) personnel, making rapid manual triage difficult during multi-site attacks2. Gurucul addresses this operational constraint through unified Threat Detection, Investigation, and Response (TDIR) powered by machine learning and automated Security Orchestration, Automation, and Response (SOAR) workflows22. Using patented Link Chain Analysis, Gurucul automatically correlates raw network events, cellular modem logs, and endpoint activity into a single contextualized evidence trail, reducing false positive alert noise by up to 70%26. High-risk events (scored on a 0–100 scale) trigger dynamic response playbooks, enabling security teams to instantly isolate compromised cellular endpoints, block unauthorized IP ranges, or notify field operators before process disruption occurs22.

    Scalable Observability and Continuous Compliance Mapping

    Gurucul’s cloud-native and hybrid architecture decouples security analytics from proprietary log storage, giving critical infrastructure operators the flexibility to ingest high-volume OT telemetry without incurring prohibitive data ingestion costs22. Furthermore, Gurucul maps behavioral detections and security events directly to established industrial frameworks, including NIST SP 800-82, ISA/IEC 62443, and CISA performance goals, providing continuous control validation and audit-ready reporting for public utility governance2.

    Strategic Outlook and Recommendations

    The July 2026 cyber campaign targeting water utilities highlights the ongoing risks facing publicly accessible industrial control systems4. As threat actors continue using automated tools to scan public IP spaces for vulnerable industrial protocols, target selection is increasingly driven by accessibility rather than facility size5. Small municipal systems remain frequent targets due to persistent network exposure, unpatched legacy hardware, and unsegmented cellular remote access links4.

    Strengthening the resilience of the Water and Wastewater Sector requires moving beyond reactive advisories toward structured, enforceable baseline security practices1. Sector leadership, municipal authorities, and regulatory partners must collaborate to ensure utilities have access to the funding, technical assistance, and architectural guidance needed to remove control hardware from the public internet1. Enforcing network segmentation, isolating remote access channels, utilizing physical key switch protections, and maintaining manual operational readiness represent essential steps to protecting critical public water infrastructure against future cyber intrusions1.

    References

    Works cited

    1. Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions – FBI, https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet–facing-programmable-logic-controllers-causing-operational-disruptions
    2. Threat intelligence update: Multistate cyber campaign targeting US water and wastewater sector Operational Technology – Shieldworkz, https://shieldworkz.com/blogs/threat-intelligence-update-multistate-cyber-campaign-targeting-us-water-and-wastewater-sector-operational-technology
    3. Minnesota & other US Water Cyber Attacks, CISA AA26-097A | Tenable®, https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know
    4. CyberAv3ngers Compromise Unitronics PLCs – Cyber – University of Hawaiʻi–West Oʻahu, https://westoahu.hawaii.edu/cyber/ics-cybersecurity/ics-weekly-summaries/cyberav3ngers-compromise-unitronics-plcs/
    5. CISA responds to active exploitation of Unitronics PLCs in water and wastewater systems sector – Industrial Cyber, https://industrialcyber.co/utilities-energy-power-water-waste/cisa-responds-to-active-exploitation-of-unitronics-plcs-in-water-and-wastewater-systems-sector/
    6. Exposed Rockwell PLCs Fuel Ongoing Water Utility Attacks – Cloud Security Alliance, https://labs.cloudsecurityalliance.org/research/csa-research-note-rockwell-plc-water-utility-attacks-2026080/
    7. US Water Systems Cyberattacks Expand To At Least 7 States: Federal Alert | Daily Voice, https://dailyvoice.com/article/cyberattacks-on-us-water-systems-expand-to-at-least-7-states-federal-alert/
    8. Hackers Hit New Jersey Water Systems: Twelve States Now Hit in attack on America’s Drinking Water – OFFGRID Survival, https://offgridsurvival.com/hackers-hit-new-jersey-water-systems-twelve-states-now-hit-in-attack-on-americas-drinking-water/
    9. OT Security Analysis: Exposed Devices Attacked in US Water Systems – Forescout, https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/
    10. FBI: Hackers Targeted Water Utility Providers in at Least 7 States – PCMag UK, https://uk.pcmag.com/security/166499/fbi-hackers-targeted-water-utility-providers-in-at-least-7-states
    11. FBI: Hackers Targeted Water Utility Providers in at Least 7 States | PCMag, https://www.pcmag.com/news/fbi-hackers-targeted-water-utility-providers-in-at-least-7-states
    12. CyberAv3ngers: FAQ About Iran-Linked Threat Group Targeting U.S. Critical Infrastructure, https://www.tenable.com/blog/what-to-know-about-cyberav3ngers-the-irgc-linked-group-targeting-critical-infrastructure
    13. Exposed Rockwell PLCs at Water Utilities: Security Implications and Guidance, https://labs.cloudsecurityalliance.org/research/csa-research-note-rockwell-plc-water-utility-exposure-202608/
    14. CyberAv3ngers, Soldiers of Soloman, Group G1027 | MITRE ATT&CK®, https://attack.mitre.org/groups/G1027/
    15. Exploitation of Unitronics PLCs used in Water and Wastewater Systems – CISA, https://www.cisa.gov/news-events/alerts/2023/11/28/exploitation-unitronics-plcs-used-water-and-wastewater-systems
    16. Unitronics Defacement Campaign, Campaign C0031 | MITRE ATT&CK®, https://attack.mitre.org/campaigns/C0031/
    17. Acquedotti USA sotto attacco con 4.407 controller industriali esposti – Matrice Digitale, https://www.matricedigitale.it/2026/08/06/acquedotti-usa-controller-plc-esposti/
    18. Hackers Target Municipal Water Systems in 7 States – Contra Costa News, https://contracosta.news/2026/08/01/hackers-target-municipal-water-systems-in-7-states/
    19. Loss of View, Technique T0829 – ICS | MITRE ATT&CK®, https://attack.mitre.org/techniques/T0829/
    20. CISA warns of attacks on Unitronics tool used by water utilities, wastewater systems, https://therecord.media/cisa-water-utilities-unitronics-plc-vulnerability
    21. What is Next Gen SIEM? | Gurucul, https://gurucul.com/cybersecurity-101/what-is-next-gen-siem/
    22. What is Next Gen SIEM? Next Generation SIEM Overview – Gurucul, https://gurucul.com/blog/what-is-next-gen-siem-next-generation-siem-overivew-gurucul/
    23. Gurucul Disrupts Next-Gen SIEM Market with Unparalleled Observability, Data Searchability and Identity-Based Threat Detection and Response, https://gurucul.com/press-releases/gurucul-disrupts-next-gen-siem-market-with-unparalleled-observability-data-searchability-and-identity-based-threat-detection-and-response/
    24. Gurucul Next Gen SIEM Reviews – PeerSpot, https://www.peerspot.com/products/gurucul-next-gen-siem-reviews
    25. UEBA vs SIEM: The Key Differences of Each Solution – Gurucul, https://gurucul.com/blog/ueba-vs-siem/
    Share.
    cyber security threat

    Related Posts

    Leave A Reply