SURIQ
None of this needed a vulnerability. The thing that let attackers into water systems across at least seven states was not a zero-day or an unpatched bug. It was a control computer answering on the public internet with the password it shipped with. On July 30, CISA told water utilities to get those devices off the internet as fast as they can. That instruction is the whole story: the exposure was the weakness.
We wrote last week about a coordinated wave that hit more than thirty Minnesota water utilities inside a single weekend, and argued that the simultaneity was the warning. It was. The scope has since grown to at least seven states reporting incidents to the FBI, and the pattern underneath every one of them is the same: programmable logic controllers (PLCs), the small industrial computers that run pumps and valves, sitting directly on the internet, reachable by anyone, guarded by a default or weak password.
What actually happened
According to Minnesota IT Services and reporting by The Record and Security Affairs, intruders changed passwords to lock operators out of their own controllers and altered the devices' network addresses to knock them offline. Some utilities issued boil-water notices and fell back to running pumps by hand. Four Minnesota cities have gone public about being hit: South St. Paul, Plymouth, Maple Plain, and Braham. According to the expanded CISA advisory, exposed devices from major industrial vendors, including Schneider Electric and Siemens, were among those reached, in each case through public exposure and default credentials rather than a flaw in the products themselves.
Attribution is not settled, and you should treat it that way. The Iran connection surfaced through a leaked WaterISAC advisory memo, and the operating pattern matches CyberAv3ngers, a persona that US agencies have previously tied to Iran's Islamic Revolutionary Guard Corps. Investigators are still working to confirm the connection, and CISA's own July 30 alert does not name Iran at all. For a defender, that ambiguity does not change a single thing you do next, which is the point of the next section.
The exposure is the vulnerability
There is no CVE to patch here, and hunting for one misreads the event. A CVE describes a flaw in code. What failed at these utilities was a decision: a management interface that belongs on a private network was placed on the public one, and left with credentials an attacker could guess or read out of a manual. That is not a software defect. It is an architecture that assumed nobody would look.
Attackers look constantly. Internet-wide scanning services index every device that answers on a public address within hours of it appearing. A controller on the open internet is not hidden for a week or even a day. It is found almost at once, cataloged by make and model, and tried against the vendor's shipped password. The work of breaking in, in these cases, was closer to logging in.
We have seen this exact movie
This is not a new technique, and that is the uncomfortable part. In late 2023, the same CyberAv3ngers persona defaced internet-exposed Unitronics controllers at US water and wastewater sites, including a booster station in Aliquippa, Pennsylvania. CISA and the EPA have issued warning after warning since then about exposed operational technology and default credentials. Nearly three years of advisories later, the exposed population was still large enough to sweep across thirty utilities in one weekend. The advisories were right. They did not move the number that mattered, which is how many of these boxes are still reachable from the internet.
This is not only a water problem
If you do not run a water utility, do not file this under someone else's industry. The failure mode is universal. Swap "controller" for any management interface that quietly ended up on a public address: a Docker daemon bound to 0.0.0.0, an IPMI or baseboard management controller on a server's out-of-band port, a database with no password, a router or self-hosted controller shipped with a fixed admin login, an internet-facing serial console. The attacker's path is identical: scan, match a default credential, take control. Water utilities are simply the most visible instance of it this week, and the one with a boil-water notice attached.
Pulling it offline is not the same as knowing you are clean
CISA's advice, get the device off the internet, is right, and it is also only the first move. Two of the actions reported in this wave, changing passwords and changing network addresses, are loud: an operator notices when the panel locks them out. But the reporting also describes attackers stealing controller project files, and that is quiet. Project-file theft is reconnaissance, not disruption, and it leaves no boil-water notice behind. A utility that pulls its controllers offline today has closed the door, but has not answered the other question: was anything read while the door was open? We have made this point before about patched-but-not-cleaned systems. The fix stops the bleeding; it does not tell you what already left. Assume any device that was exposed and reachable was also enumerated, and treat its configuration and stored logic as potentially in someone else's hands.
What to do today
CISA's list is short, and it applies to far more than industrial controllers. For every management interface you run, in the order that matters:
- Take it off the public internet. If remote access is genuinely needed, put it behind a VPN or a jump host, never a direct public port.
- Allowlist the source addresses that can reach it, down to the specific engineering or admin machines.
- Change every default and shared password, and confirm none of the vendor defaults survive.
- Keep a verified-clean configuration backup you can restore from, stored offline.
- Audit the paths you forgot: undocumented cellular modems, an old jump box, a contractor's VPN, a device someone stood up for a demo and never took down.
The single most useful thing you can do this week is smaller than any of those. Inventory what of yours currently answers on a public address. The water utilities were not hit because attackers were sophisticated. They were hit because something was reachable that should not have been, and nobody had a current list of what that included.