Minnesota IT Services (MNIT) confirmed on July 28 that a coordinated cyberattack struck operational technology at more than 30 municipal water and wastewater systems across the state on July 26 and 27, forcing at least one treatment plant offline and pushing several others onto manual control. It is the largest simultaneous OT incident against U.S. water infrastructure so far this year, and it lands squarely on top of a threat CISA has been warning about since April.

What Happened

The first public reports came from four cities — Braham, Plymouth, South St. Paul, and Maple Plain — before MNIT confirmed Tuesday that the actual count of affected communities had passed 30. In Braham, attackers reached the water plant over a wireless/cellular modem link and used it to shut down operating controls directly, rather than pivoting in through IT. Similar cellular and wireless entry points were the common thread across the other affected utilities. No changes to drinking water quality were reported, and no utility issued a boil-water or usage advisory, but multiple plants had to run on manual operator control while incident responders worked the compromised systems.

MNIT activated the state’s cybersecurity incident response capability and is working with CISA, the FBI, EPA, and DOE. Attribution has not been confirmed, but the timing lines up closely with the ongoing campaign described in CISA joint advisory AA26-097A, which tracks Iranian-affiliated actor CyberAv3ngers exploiting internet-exposed PLCs across water, energy, and government sectors. CISA updated that advisory on July 22 — days before the Minnesota incident — to expand the observed exploitation scope from Rockwell Automation controllers to include Schneider Electric and Siemens PLCs, and added detection guidance for tampering with reusable code modules embedded in PLC programs, plus the first documented cases of project-file exfiltration rather than just on-device manipulation.

Technical Details

The exploitation pattern matches the AA26-097A playbook: internet-facing PLCs reached via exposed cellular/wireless modems or remote-access paths, no phishing or credential theft required. Where the underlying vulnerability is known, it traces back to CVE-2021-22681 (CVSS 9.8), an insufficiently protected cryptographic key in Rockwell’s Studio 5000 Logix Designer and multiple Logix PLC families that lets an attacker forge session tokens and push unauthorized project-file changes. The advisory also documents Dropbear SSH being dropped on port 22 for persistent C2, and communication with compromised devices over EtherNet/IP (44818, 2222) and Modbus TCP (502).

Impact

The immediate impact is operational, not a water-safety event: affected utilities lost automated control and had to run treatment and distribution manually until systems could be verified clean. The broader significance is scale — this is the first time the CyberAv3ngers-linked campaign has produced a confirmed, simultaneous, multi-utility disruption inside the U.S. rather than isolated single-site compromises. Any water, wastewater, energy, or municipal operator running Rockwell, Schneider Electric, or Siemens PLCs with any form of remote or cellular access is in the exposure set CISA is describing.

Mitigation

  • Get PLCs off the public internet and off unmonitored cellular/wireless links. Route all remote access through a monitored VPN with MFA; log every cellular modem connection.
  • Audit for Dropbear SSH on port 22 on OT devices — its presence is a strong compromise indicator.
  • Inspect running project files against known-good backups before restoring from backup or returning a controller to run mode; validate the file, then only physically flip the run/mode switch afterward.
  • Apply Rockwell’s defense-in-depth guidance: network segmentation, engineering-workstation isolation, and CIP Security enablement.
  • Patch CVE-2021-22681 if it hasn’t been already — it’s been in CISA’s KEV catalog since March.

Sources: CISA AA26-097A, The Hacker News, BleepingComputer, SecurityWeek.