A coordinated cyber campaign in July 2026 targeted operational technology at more than 30 Minnesota community water systems and related facilities in at least seven U.S. states. Attackers accessed internet-facing Allen-Bradley MicroLogix 1100/1400 PLCs, changed device IP addresses and passwords to lock out operators, and modified ladder logic, causing loss of water pressure, flooding, and reliance on manual operations. The campaign shares technical characteristics with an Iranian-affiliated PLC-targeting operation documented in Joint Cybersecurity Advisory AA26-097A, but attribution remains unconfirmed. Concurrent pro-Russian hacktivist activity (NoName057(16) and Z-Pentest) targeted Canadian water systems, demonstrating that multiple actor types are exploiting exposed OT infrastructure using legitimate engineering tools rather than advanced ICS malware.
Iranian APT
2 posts
Review of the July 2026 Cyberattacks Against U.S. Water and Wastewater Systems Inside Pay2Key: Technical Analysis of a Linux Ransomware Variant Morphisec Threat Labs analyzed a Linux variant of the Iranian-attributed Pay2Key ransomware. The malware requires root privileges to execute, utilizes a JSON configuration file, disables system defenses like SELinux and AppArmor, and employs ChaCha20 for full or partial file encryption while lacking built-in network C2 or exfiltration capabilities.
