On the night of July 26, 2026, an operator at the water plant in Braham, Minnesota — population 1,900 — watched the SCADA dashboard stop responding. The plant hadn’t been port-scanned from the open internet. Nobody had phished an employee. The attacker came in over the cellular modem the utility used for remote telemetry, a link that had never appeared on a firewall rule review because it wasn’t routed through the firewall at all. By the time Minnesota IT Services finished counting on July 28, more than thirty municipal water and wastewater systems across the state had been hit the same weekend, in what state officials confirmed was a coordinated attack. At least one plant went fully offline. Several more ran on manual operator control while responders worked the compromised controllers.
Every mitigation checklist published in the following week said the same thing: get your PLCs off the internet. That advice is correct and it is also, for this specific campaign, close to beside the point. Braham’s controller was never internet-routable in the way a Shodan scan would find it. It was reachable over a private wireless link that exists specifically because someone decided it shouldn’t be on the corporate network. The attackers didn’t beat the segmentation. They walked around the side of it.
The Advisory That Predicted Its Own Sequel
CISA had been telling everyone this was coming. Joint advisory AA26-097A — co-authored by the FBI, CISA, NSA, EPA, DOE, and U.S. Cyber Command — went out on April 7, 2026, attributing an active campaign against internet-exposed Rockwell Automation/Allen-Bradley PLCs to CyberAv3ngers, a persona tied to Iran’s IRGC Cyber Electronic Command and tracked elsewhere as Shahid Kaveh Group, Hydro Kitten, Storm-0784, and UNC5691. The advisory laid out a four-stage playbook that reads, in hindsight, like a spec sheet for what happened in Minnesota:
- Initial access to an exposed PLC — no phishing, no credential theft, just direct exploitation of the device or its engineering protocol.
- Persistence via Dropbear SSH dropped on port 22, giving the operator a lightweight, low-footprint C2 channel that most OT monitoring never expects to see on a controller.
- Extraction and modification of PLC project files — the ladder logic and configuration that actually define what the controller does.
- SCADA/HMI display manipulation, so operators watching their dashboards see normal readings while modified logic runs underneath.
Step four is the one worth sitting with. This is not a denial-of-service. It’s the Stuxnet pattern in miniature — feed the operator a plausible lie on the screen while the physical process runs something else — and it’s why the FBI’s July 30 joint PSA with EPA (I-073026-PSA) explicitly warned about operational disruption and pressure loss, not just downtime. On July 22, four days before the Minnesota incident, CISA quietly updated AA26-097A to expand the observed target set from Rockwell alone to also include Siemens and Schneider Electric PLCs, and added detection guidance for tampering with reusable code modules and for project-file exfiltration — a capability nobody had confirmed in the original April advisory. The update reads like CISA watching the campaign mature in real time. Four days later, it produced the largest simultaneous OT incident against U.S. water infrastructure this year.
A Five-Year-Old CVE That Was Never Really Patched
The named vulnerability, CVE-2021-22681 (CVSS 9.8), sits in Rockwell’s Studio 5000 Logix Designer and the ControlLogix, CompactLogix, GuardLogix, FlexLogix, and SoftLogix families. The bug is an insufficiently protected cryptographic verification key — the mechanism Logix Designer uses to prove a session is talking to a legitimate engineering workstation is hardcoded and extractable, which means an attacker who can reach the device’s EtherNet/IP interface can forge a session and push unauthorized project-file changes without ever touching a password.
That’s the detail that makes “patch it” unsatisfying advice. Rockwell disclosed this in 2021 with compensating-controls guidance — network isolation, VPN gatewaying, and enabling CIP Security — because there is no conventional patch that fixes a cryptographic-key design flaw baked into how the protocol authenticates. CISA didn’t add it to the Known Exploited Vulnerabilities catalog until March 2026, five years after disclosure, once in-the-wild exploitation was confirmed. A federal remediation deadline followed. Most affected organizations spent five years treating this as a theoretical finding on a vendor advisory nobody re-read, because “compensating controls, no real patch” is the kind of finding that gets triaged into a backlog and never comes back out.
Communication with compromised controllers rode on the protocols you’d expect: EtherNet/IP on 44818 and 2222, Modbus TCP on 502, and the Dropbear backdoor on 22. None of that is exotic. All of it is well-documented, well-signatured traffic that any OT-aware monitoring tool should flag on sight — the barrier isn’t detection capability, it’s that most of these networks have no monitoring watching those ports at all.
From “1111” to a Coordinated Multi-Vendor Campaign
CyberAv3ngers didn’t arrive at this sophistication overnight, and the arc is worth tracing because it tells you where this campaign goes next. In November 2023, the same actor set compromised a Unitronics Vision PLC at the Municipal Water Authority of Aliquippa, Pennsylvania, using nothing more advanced than the device’s default administrative password — “1111” — over its proprietary PCOM protocol. The defacement message was explicit: any equipment “made in Israel” was a “legal target.” CISA’s response at the time was almost entirely about credential hygiene: stop shipping default passwords, stop leaving them unchanged.
By mid-2024, Claroty’s Team82 identified IOCONTROL, a custom Linux malware platform attributed to the same actor ecosystem, using MQTT-over-TLS for C2 across a much wider device set — routers, HMIs, IP cameras, firewalls, fuel-management systems, PLCs from multiple vendors. That was the pivot from “exploit one Israeli manufacturer’s weak default credential” to “build a reusable cross-vendor OT intrusion platform.” The Minnesota campaign is the next step again: living off a legitimate engineering protocol against the dominant U.S. industrial vendor, backed by a documented persistence mechanism, executed against thirty-plus targets in a single coordinated window, then expanded to two more major vendors within the same advisory cycle. Four years, three campaigns, and each one trades opportunism for repeatability. That trajectory should worry you more than any individual CVE in the advisory.
Sophistication Isn’t the Bottleneck — Exposure Is
It’s worth contrasting this campaign against ZionSiphon, the OT-sabotage malware Darktrace wrote up in April 2026 as a purpose-built weapon targeting Israeli desalination and water treatment plants — chlorine-dosing and pressure-manipulation logic, ICS protocol scanning, a USB propagation stage. Dragos looked at the same sample and called it something closer to a poorly-executed, likely LLM-assisted prototype: broken validation logic, partially implemented protocol stacks, unsophisticated by the standards of real ICS weapons. Both assessments can be true at once, and the disagreement is itself the lesson. ZionSiphon looked like Stuxnet-lineage malware and, per Dragos, wasn’t operationally credible. The Minnesota campaign looked like nothing more advanced than a known CVE, a public SSH implementation, and legitimate protocol traffic — and it took down operator control at thirty-plus sites simultaneously.
The industry has spent two decades benchmarking OT threats against Stuxnet, Industroyer, and Trisis — malware built by nation-states with the resources to reverse-engineer proprietary safety-instrumented-system internals. That lineage is real and it matters for understanding capability ceilings, but it’s the wrong yardstick for what’s actually causing operational disruptions in 2026. FrostyGoop, disclosed by Dragos in April 2024, needed nothing more exotic than fluent Modbus TCP to disable heat delivery to roughly 600 apartment buildings in Lviv for two days. CyberAv3ngers needed a five-year-old auth bypass and a stock SSH daemon to hit thirty U.S. water utilities in a weekend. Sophistication is not the bottleneck holding attackers back from disrupting critical infrastructure. Exposure is — and exposure, for OT, does not mean “has a public IP.”
The Blind Spot Every Exposure Statistic Misses
Every headline exposure number circulating this year measures the same thing: what’s reachable from the general internet. Censys counted roughly 4,400 Rockwell PLCs exposed globally in early August 2026, with 22 traced directly to the affected Minnesota cities. An earlier Censys pass tied to the April advisory found 5,219 hosts self-identifying as Rockwell/Allen-Bradley gear over EtherNet/IP, 74.6% of them in the United States. Claroty’s State of CPS Security 2025 sampled roughly a million OT devices across 270 organizations and found 111,000 carrying a Known Exploited Vulnerability, 68% of those tied to active ransomware groups. Bitsight put aggregate global ICS/OT exposure north of 200,000 monthly unique IPs across fifteen monitored protocols.
Those numbers are real and useful, and none of them would have flagged Braham. The attacker reached that plant over a cellular or wireless modem — infrastructure installed for legitimate remote telemetry, provisioned by a vendor or contractor, running on a carrier’s private APN rather than a routable public IP. It doesn’t show up in a Shodan query. It doesn’t show up on the firewall rule review, because it was never behind the firewall. It very often doesn’t show up in the OT asset inventory at all, because whoever racked the modem five years ago considered it a telemetry accessory, not a network ingress point requiring the same governance as a VPN concentrator.
This is the actual gap in the “get it off the internet” doctrine: it assumes internet exposure is the only kind of remote-access exposure worth auditing. Cellular and wireless links attached directly to control systems — for SCADA polling, for remote diagnostics, for vendor support access — are a second, mostly invisible attack surface that internet-exposure scanning structurally cannot see, because it was never designed to look for it.
What Actually Reduces Risk Here
None of this is exotic to fix. It requires treating remote-access inventory as a first-class OT security control instead of a networking afterthought.
Inventory every path into OT that isn’t a wire you control — cellular modems, wireless bridges, vendor remote-support tunnels, satellite links. If it can carry a Logix Designer session, Modbus traffic, or an SSH connection into a controller, it belongs on the same asset register and change-control process as a public IP, full stop.
Enable CIP Security wherever Logix controllers are deployed. Since CVE-2021-22681 has no conventional patch, mutual authentication at the protocol layer is the only control that actually closes the forged-session path Rockwell’s own advisory describes.
Hunt for Dropbear SSH on port 22 across every OT device. It’s a stock binary with a distinctive banner, and CISA handed you this IOC directly. A single Zeek or Suricata rule watching for the Dropbear SSH version string on any host in the OT VLAN is cheap, high-fidelity, and takes an afternoon to deploy:
1 2 3 4alert tcp $OT_NET any -> any 22 (msg:"OT-IOC Dropbear SSH banner on controller segment"; \ content:"SSH-2.0-dropbear"; offset:0; depth:20; \ reference:url,cisa.gov/news-events/cybersecurity-advisories/aa26-097a; \ classtype:trojan-activity; sid:9000101; rev:1;)Diff project files before restoring run mode, not after. Never trust the HMI display as ground truth for whether a controller is clean — the entire point of the campaign’s fourth stage is that the display lies. Restore from a known-good, offline backup, validate the ladder logic against it, and only then flip the physical run/mode switch.
Block 44818, 2222, 502, and 22 at every OT perimeter that isn’t explicitly required to pass them — including the cellular gateway, not just the corporate firewall.
Route engineering workstation access through a monitored jump host with MFA and session recording. If a Logix Designer session can originate from anywhere other than a specific, audited workstation, that’s the actual attack surface, independent of whatever’s happening at your internet edge.
Braham, population 1,900, and Minot, North Dakota’s fourth-largest city, both got hit by different classes of attacker this year using the same underlying weakness: remote access into OT that nobody was watching as closely as the front door. Scale doesn’t buy you obscurity in this threat model. Exposure does the targeting for the attacker; your job is to find every path in before they do, including the ones that were never supposed to count as “on the network” in the first place.