Iran-Linked Hackers Hit Water Utilities in 12 States. The Way in Was a Cellular Modem Nobody Was Watching
In late July, hackers reached programmable logic controllers at water and wastewater facilities across at least seven states, a small-town Minnesota water system among the first hit. Minnesota alone had more than 30 municipal systems affected in a single weekend. By last week, the count had grown to twelve states, and new incidents were still surfacing in Georgia and South Dakota on top of the original cluster.
This isn’t a story about water utilities suddenly becoming interesting to a nation-state. It’s a story about how exposed they already were, and how long that exposure sat there unnoticed. Every incident traces back to the same root cause: a cellular modem connected directly to a public IP address, installed for remote access convenience, then forgotten by everyone who could have secured it.
Critical infrastructure has always been a target. CISA’s advisory on Volt Typhoon detailed a China state-sponsored actor pre-positioned inside US power, water, and transportation networks. The Salt Typhoon advisory described a similar campaign against telecommunications infrastructure. Both show the same pattern: state actors sitting inside ordinary connected equipment, waiting for a foothold to become useful. This campaign fits that pattern, aimed at a cellular entry point instead of a core network one.
Here’s how the access actually happened, why patching the underlying flaw won’t close the gap on its own, and what closing it actually requires at the network layer.
What Actually Happened
The pattern is consistent across every state that has reported an incident so far. A joint advisory from CISA, the FBI, and the EPA describes attackers modifying PLC passwords to lock out legitimate operators, changing controller IP addresses to disconnect them from monitoring systems, and reaching the devices through vulnerable cellular modems installed by vendors and integrators.
In Minnesota, that meant a field-deployed PLC in Plymouth connected to a cellular modem on the public carrier network with no gateway or security layer in front of it, sitting on a public IP that anyone scanning the internet could find. In South Dakota, a Rapid City lift station was affected the same way. In Georgia, Clayton County Water Authority saw a pressure drop and issued a boil water advisory, restored within hours.
The equipment itself spans every major vendor in water sector OT: Rockwell Automation Allen-Bradley, CompactLogix, and Micro850 controllers, Siemens S7-1200s, and Schneider Electric Modicon M340s. This wasn’t a single-vendor flaw. It was a single architecture pattern repeated at thousands of sites.
No one has formally attributed the campaign yet, but the circumstantial case for Iran is strong. Cynthia Kaiser, former deputy assistant director of the FBI’s Cyber Division, told PBS NewsHour she “would be shocked if Iran wasn’t behind this attack,” pointing to a geopolitical rather than financial motive and a pattern of stopping at control-device access instead of causing physical damage. Other reporting points to the same tactics, techniques, and procedures (TTPs) used in the 2023 CyberAv3ngers campaign, which exploited default credentials on Israeli-made Unitronics PLCs.
Why Patching Won’t Close This
A lot of the coverage has focused on CVE-2021-22681, an authentication bypass in Rockwell Logix controllers that reportedly gave attackers access to a portion of the affected devices. Rockwell has said it can’t be patched without redesigning the product line. That detail has led some of the broader reporting on the campaign to frame this as a vulnerability problem.
It isn’t, not primarily. Even a fully patched PLC sitting behind an unmanaged cellular modem on a public IP is still reachable by anyone who scans for it. Security researchers using Censys, have found somewhere between 3,900 and 10,000 PLCs from these same vendor families exposed on the public internet right now, most of them reached the same way: a consumer-grade router or modem bridging a field device straight to the internet.
Both the CVE and the modem are part of how attackers got in, not what they did once inside. The distinction that matters is architectural: a device reachable from the public internet is exposed regardless of which vulnerability eventually gets used against it.
The Gap Is Visibility, Not Cellular
Cellular connectivity isn’t the risk here. Most private and carrier-based cellular deployments in water and wastewater operate exactly as designed. The risk is a cellular connection nobody is tracking: a modem installed years ago for a vendor to do remote maintenance, still live, still reachable, with no one on the utility’s team able to say what’s actually behind it.
A SIM tells you a connection exists. It says nothing about whether the device behind it belongs there, what it’s talking to, or whether it’s sitting on a public IP address it should never have touched. That distinction is the entire gap these attacks walked through.
What Closing the Gap Actually Requires
CISA’s mitigations, get PLCs off the public internet, replace consumer modems with secured gateways, segment the network, and monitor OT traffic, are the right immediate steps Making them durable means building three capabilities most water utilities don’t have today:
- A live inventory of every device behind every cellular modem, including the ones nobody remembers installing, not just the assets in the original deployment plan.
- Continuous monitoring of which devices are actually reaching the public internet. Most of these PLCs should never be reachable from outside the network at all, and most teams have no way to know when one is.
- Identity-based Zero Trust segmentation enforced down to the device and the SIM, so a compromised credential on one controller doesn’t grant the same access an authorized engineer would have.
None of this requires ripping out the cellular connectivity that makes remote water infrastructure operable in the first place. It requires knowing what’s actually connected to it.
The vulnerability that mattered in this campaign wasn’t the CVE. It was the connection nobody could see.
If your team runs cellular-connected OT and can’t say with confidence what’s on that network right now, request a cellular device discovery assessment.