CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

CISA is observing a significant increase in cyber threat actors targeting programmable logic controllers (PLCs) in the Water and Wastewater Systems (WWS) Sector. Threat actors have been modifying passwords to lock out operators and changing IP addresses to disconnect PLCs, resulting in boil water notices and sustained manual operations. The activity targets water entities of all sizes, including through undocumented cellular modems installed by operators or vendors. CISA urges critical infrastructure owners to disconnect PLCs from the internet immediately and route remote access through VPNs or gateway devices. Recommended mitigations include enabling password protection, changing default passwords, and allowlisting IPs for remote access. Rockwell Automation MicroLogix 1400 PLC users are directed to a specific advisory for restoring access when passwords are unknown. The alert was jointly developed with the EPA and FBI, and organizations can contact EPA's Cybersecurity Technical Assistance Program or CISA Regional Offices for support.