Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – Attackers abused internet-facing PLCs and remote-access paths to reach OT devices (‘internet-facing PLCs’ and ‘exposed controllers’).
• [T1021 ] Remote Services – The actors used remote access to connect to controllers and infrastructure over exposed services (‘remote-access services’ and ‘remotely accessed exposed PLCs’).
• [T1078 ] Valid Accounts – Attackers changed passwords and likely leveraged credentials or weak authentication to maintain access (‘changed their IP addresses and passwords’).
• [T1606 ] Forge Web Credentials / Password Manipulation – Credential and access settings on PLCs were altered to block operator access (‘changed their IP addresses and passwords’).
• [T0831 ] Manipulation of Control – The campaign modified PLC logic and control behavior to affect physical processes (‘modified control logic’ and ‘changed ladder logic’).
• [T0829 ] Remote System Discovery – Operators identified malicious interaction across multiple sites and devices, indicating reconnaissance of exposed OT assets (‘multiple victims’ and ‘similar hardware and remote-access architectures’).
• [T0883 ] Establish Accounts / Persistence via Configuration Change – Attackers used configuration changes on controllers and modems to preserve access or disrupt recovery (‘modified PLC project files’ and ‘Dropbear SSH on a victim modem’).
• [T0868 ] Alarm Suppression – The advisory notes changes that disabled critical alarms and shutdown logic (‘disabled critical alarms and shutdown logic’).
• [T0886 ] Remote Services: SSH – Dropbear SSH was used on a victim modem to establish remote access (‘Dropbear SSH on a victim modem’).