CISA Alert: Defending Water Utilities Against Internet-Exposed PLC Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding a significant uptick in cyberattacks targeting water and wastewater systems. The core issue driving this wave of intrusions is the exposure of Programmable Logic Controllers (PLCs) directly to the public internet.

For defenders, this is not a theoretical risk. We are seeing active disruption of operational environments. When a safety-critical PLC is internet-exposed, the attack surface shifts from "air-gapped" physics to publicly reachable TCP/IP sockets. The barrier to entry for threat actors drops significantly, allowing for reconnaissance, unauthorized modification of ladder logic, and physical disruption of water treatment processes.

This post provides the technical breakdown and defensive playbooks required to identify and neutralize this threat immediately.

Technical Analysis

Affected Assets The advisory specifically highlights internet-exposed PLCs within the Water and Wastewater Systems (WWS) sector. While specific vendor exploits vary, the common denominator across all recent incidents is the network architecture: controllers managing pumps, valves, and chemical dosing are reachable via the public internet without adequate access controls or VPN tunneling.

Attack Vector The primary attack vector is the exposure of OT management ports (e.g., TCP 102, TCP 502, TCP 2404) to the global internet.

• Reconnaissance: Attackers scan for these specific ports on IP ranges associated with utilities.
• Initial Access: Upon identifying an exposed PLC, actors attempt brute-force authentication against administrative interfaces or exploit unpatched firmware vulnerabilities.
• Impact: Once authenticated, actors can alter setpoints, stop pumps, or rewrite logic, directly impacting physical safety and water availability.

Exploitation Status CISA has confirmed active exploitation resulting in disruption. This is not a proof-of-concept scenario; adversaries are currently leveraging this misconfiguration to hold infrastructure hostage or cause mechanical damage.

Detection & Response

The following detection logic focuses on identifying ingress traffic from the internet into the OT environment and suspicious management station activity. Since PLCs often lack extensive logging, network telemetry (firewalls, IDS, and span ports) is your primary source of truth.

SIGMA Rules

---
title: Internet Inbound Access to OT Protocol Ports
id: 9a1f2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects incoming connection attempts from external IP ranges to common PLC protocol ports (Modbus, S7, DNP3).
references:
  - https://www.cisa.gov/news-events/alerts/2023/03/18/cisa-warns-active-exploitation-ics-plcs
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
  - ics
logsource:
  category: firewall
  product: any
detection:
  selection:
    DestinationPort:
      - 102  # Siemens S7
      - 502  # Modbus TCP
      - 2404 # DNP3
      - 44818 # Ethernet/IP
  filter_internal:
    SourceIP|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_internal
falsepositives:
  - Authorized remote access via misclassified VPN IP
level: critical
---
title: Suspicious Process Spawning OT Discovery Tools
id: b2c3d4e5-f6a7-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects execution of common OT scanning or scripting tools on engineering workstations.
references:
  - https://attack.mitre.org/techniques/T1595/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t1595
  - ics
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\python.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  selection_cli:
    CommandLine|contains:
      - 'Modbus'
      - 's7comm'
      - 'dnp3'
      - 'enip'
  condition: all of selection_*
falsepositives:
  - Legitimate engineering testing or script execution
level: high

KQL (Microsoft Sentinel / Defender)

// Hunt for inbound connections to common PLC ports from External IPs
let OT_Ports = dynamic([102, 502, 2404, 44818, 2222]);
let Private_Ranges = dynamic(["10.", "192.168.", "172.16.", "127."]);
CommonSecurityLog
| where DeviceVendor in ("Cisco", "Palo Alto Networks", "Fortinet", "Check Point")
| where DestinationPort in (OT_Ports)
| where SourceIP !has_any (Private_Ranges) 
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, ApplicationProtocol
| order by TimeGenerated desc

Velociraptor VQL

-- Hunt for established network connections to known OT ports
-- Run on Engineering Workstations or Jump Servers
SELECT Pid, Name, RemoteAddress, RemotePort, State, Family
FROM netstat()
WHERE State = 'ESTABLISHED'
  AND RemotePort IN (102, 502, 2404, 44818)
  AND Family = 'AF_INET'

Remediation Script (PowerShell)

# Audit and Report Internet-Facing Firewall Rules for OT Ports
# Requires administrator privileges

$CriticalPorts = @(102, 502, 2404, 44818)
$Rules = Get-NetFirewallRule -PolicyStore ActiveStore | 
          Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' }

Foreach ($Rule in $Rules) {
    $Ports = Get-NetFirewallPortFilter -AssociatedObject $Rule
    $Address = Get-NetFirewallAddressFilter -AssociatedObject $Rule
    
    # Check if rule allows Any remote address or a specific Internet range
    $IsExposed = $false
    if ($Address.RemoteAddress -eq "Any") { $IsExposed = $true }
    
    if ($IsExposed -and $Ports.Protocol -eq "TCP") {
        foreach ($Port in $CriticalPorts) {
            if ($Ports.LocalPort -like "*$Port*" -or $Ports.LocalPort -eq $Port) {
                Write-Host "[CRITICAL] Rule: $($Rule.DisplayName) allows TCP $Port from Any/Internet." -ForegroundColor Red
            }
        }
    }
}

Remediation

Immediate action is required to secure these controllers and comply with CISA directives.

1. Immediate Isolation: Identify all PLCs with public IP addresses. Disconnect them from the internet immediately. Place them behind a dedicated firewall or demilitarized zone (DMZ).

2. VPN Enforcement: Remote access to OT networks must be enforced via Multi-Factor Authentication (MFA) protected VPNs. No direct RDP, SSH, or web interface access should be allowed from the internet.

3. Network Segmentation: Ensure strict segmentation between the IT network and the OT network. Verify that traffic can only flow between specific jump hosts and the PLCs on required ports.

4. Audit and Patch: Conduct a firmware audit of all PLCs. Apply the latest security patches from the vendor. Change all default credentials on PLCs and HMIs immediately.

5. Intrusion Detection: Deploy passive monitoring (IDS/IPS) signatures for OT protocols within the control network to detect malformed packets or anomalous ladder logic writes.

Official Resources:

• CISA Joint Alert: Active Exploitation of PLCs
• CISA ICS-CERT Advisories

Related Resources

Security Arsenal Healthcare Cybersecurity AlertMonitor Platform Book a SOC Assessment healthcare Intel Hub