Iranian threat actors' Water and Wastewater Systems PLC targeting campaign
Campaign
Summary
Hide ▲
Show ▼
A campaign tied to Iranian threat actors targeted over 100 internet-exposed water systems in July 2026, signaling a broad operation against critical OT environments. The activity focused on Water and Wastewater Systems (WWS) and frequently used PLCs connected directly to cellular modems as the exposure path. The operation sought to cause disruption to OT systems, but it did not achieve significant disruption. The event prompted updated sector guidance to reduce internet exposure and harden remote access.
Related Happenings
CISA KEV multi-vulnerability exploitation wave
Exploitation Wave
H score59
First: 03.09.2026 08:19
Last: 03.09.2026 08:19
Sources 1
About this happening:
CISA's KEV list gained seven exploited flaws, signaling active abuse across SonicWall SMA 1000, Sangoma Switchvox, JFrog Artifactory, Starlette, Kestra O...
CISA KEV multi-vulnerability exploitation wave
Exploitation WaveAbout this happening: CISA's KEV list gained seven exploited flaws, signaling active abuse across SonicWall SMA 1000, Sangoma Switchvox, JFrog Artifactory, Starlette, Kestra O...
Claude-assisted porting of a WAGO 750-852 RCE exploit to WAGO 750-831
Technical Analysis
H score14
First: 01.09.2026 15:37
Last: 01.09.2026 15:37
Sources 1
About this happening:
Forescout’s Vedere Labs showed that Anthropic’s Claude could adapt a working RCE exploit from WAGO 750-852 to the related WAGO 750-831, increasing concern that...
Claude-assisted porting of a WAGO 750-852 RCE exploit to WAGO 750-831
Technical AnalysisAbout this happening: Forescout’s Vedere Labs showed that Anthropic’s Claude could adapt a working RCE exploit from WAGO 750-852 to the related WAGO 750-831, increasing concern that...
Siemens S7 PLC AI-assisted exploitation campaign targeting critical infrastructure
Campaign
H score17
First: 19.08.2026 20:50
Last: 19.08.2026 20:50
Sources 1
About this happening:
The U.S. government warned of an active threat using AI-generated exploit scripts against Siemens S7 Series PLCs in U.S. critical infrastructure. The campaign...
Siemens S7 PLC AI-assisted exploitation campaign targeting critical infrastructure
CampaignAbout this happening: The U.S. government warned of an active threat using AI-generated exploit scripts against Siemens S7 Series PLCs in U.S. critical infrastructure. The campaign...
Russian Electrum Poland energy-sector destructive campaign
Campaign
H score43
First: 11.08.2026 02:07
Last: 11.08.2026 02:07
Sources 1
About this happening:
The Russian Electrum-linked December 29, 2025 operation expanded into a multi-site destructive campaign against Poland's energy sector, targeting 30 wind and solar i...
Russian Electrum Poland energy-sector destructive campaign
CampaignAbout this happening: The Russian Electrum-linked December 29, 2025 operation expanded into a multi-site destructive campaign against Poland's energy sector, targeting 30 wind and solar i...
Minnesota water OT exposed PLC coordinated cyberattack campaign
Campaign
H score65
First: 31.07.2026 19:49
Last: 31.07.2026 19:49
Sources 1
About this happening:
A coordinated cyberattack is disrupting more than 30 Minnesota community water systems, forcing some operators onto manual operations and increasing the risk of wider...
Minnesota water OT exposed PLC coordinated cyberattack campaign
CampaignAbout this happening: A coordinated cyberattack is disrupting more than 30 Minnesota community water systems, forcing some operators onto manual operations and increasing the risk of wider...
Timeline
-
26.08.2026 14:29 2 articles · 13d ago
Iranian threat actors' Water and Wastewater Systems PLC targeting campaign
Initial DisclosureIn July 2026, CISA detected malicious activity against over 100 WWS systems exposed to the internet. The common exposure path was PLCs reached through cellular modems.
Show sources
- CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks — www.securityweek.com — 26.08.2026 14:29
- CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks — www.securityweek.com — 26.08.2026 14:29