CyberAv3ngers Hits 30+ Minnesota Water Utilities: CISA AA26-097A Updated Advisory for PLC Operators

Incident Summary

On July 26-27, 2026, CyberAv3ngers — a threat group attributed with high confidence to Iran’s Islamic Revolutionary Guard Corps Cyber Command (IRGC-CC) — executed a coordinated attack against more than 30 municipal water utilities in Minnesota. The Braham, Minnesota water treatment plant was taken entirely offline. Plymouth reported disruption to cellular communications at water towers and lift stations, requiring a shift to manual operations. Multiple other utilities issued boil water notices.

The FBI has confirmed attacks across seven US states during the same window; Minnesota is the most publicly reported cluster but not the full scope of the campaign.

CISA updated advisory AA26-097A — Iranian-Affiliated Cyber Actors Exploit PLCs in Water and Wastewater Systems — in direct response, adding detection guidance specific to malicious code module changes in Rockwell Automation environments.

Attack Vectors

Two distinct exploitation paths were used in the July 26-27 attacks:

1. Unitronics Vision Series — Default Credentials

Unitronics Vision Series PLCs were accessed using factory-default passwords. These controllers are widely deployed in small to mid-sized US water utilities for treatment monitoring and pump control.

CyberAv3ngers has used default credential exploitation against Unitronics hardware previously — the same vector was confirmed in the November 2023 Aliquippa Municipal Water Authority attack. After gaining access through default credentials, attackers modified controller passwords to lock legitimate operators out of treatment control systems.

Affected controllers: Unitronics Vision Series (all models using default Visilogic password configuration)

No CVE is assigned — this is not a software vulnerability. It is an operational configuration failure: PLCs shipped with default passwords that operators have not changed.

2. CVE-2021-22681 — Rockwell Automation PLC Authentication Bypass

Attackers also exploited CVE-2021-22681, a authentication bypass vulnerability in Rockwell Automation (Allen-Bradley) PLCs affecting the CIP (Common Industrial Protocol) implementation. The flaw allows an attacker with network access to forge authentication messages and gain unauthorized access to the PLC.

CVE-2021-22681 characteristics:

CVSS 3.1: 10.0 (Critical)
Authentication required: None
Network access required: Yes (direct network path to affected PLC)
Patch status: Rockwell has issued mitigations; the affected CIP design cannot be fully patched without protocol-level changes. Rockwell’s response centers on network segmentation rather than elimination of the vulnerability.

Affected products (representative):

Rockwell Automation Logix Designer (Studio 5000)
ControlLogix 1756-L series
CompactLogix 1769-L series
MicroLogix 1100 and 1400

The full affected product list is documented in CISA ICS Advisory ICSA-21-056-03.

CISA AA26-097A — What Changed

Advisory AA26-097A was previously issued during the March-June 2026 Iranian PLC campaign. The July 29 update adds:

New detection guidance for Rockwell Automation environments:

Detection rules for unauthorised code module additions or modifications in Logix project files. CyberAv3ngers has been observed inserting ladder logic rungs that alter treatment setpoints or disable alarms without modifying the primary program structure.
Indicators of credential manipulation events (password hash modification, access level changes) via CIP messages.
Network traffic signatures for authentication bypass attempts using CVE-2021-22681 exploitation patterns.

Operators running Rockwell/Allen-Bradley PLCs should implement the detection recommendations in the updated advisory regardless of whether their systems are directly internet-facing. Lateral movement from an initially compromised IT system is a viable path to Rockwell hardware in environments where IT/OT network segmentation is incomplete.

Threat Context

Handala Threat Declarations

Three days before the Minnesota attacks — on July 23, 2026 — Handala, a separate Iranian threat group attributed to Iran’s Ministry of Intelligence and Security (MOIS), issued explicit statements declaring US water, electricity, and transportation infrastructure as priority targets. Handala separately claimed attacks on Maryland OT infrastructure and California Water Service.

The temporal relationship between Handala’s threat declarations on July 23 and CyberAv3ngers’ execution on July 26-27 is consistent with coordinated tasking or parallel operations under shared Iranian cyber campaign directives, rather than coincidence.

Operational Pattern

CyberAv3ngers has followed a consistent escalation pattern:

Year	Activity
2023	Aliquippa, PA — PLC access demonstrated, anti-Israel message displayed
2024–2025	Continued opportunistic PLC scanning and access
June 2026	Coordinated multi-state campaign; CISA AA26-097A first issued
July 26-27, 2026	30+ Minnesota utilities; Braham plant offline — first confirmed operational disruption at scale

The shift from demonstrative access to operational disruption — taking a plant offline and forcing manual operation — represents a meaningful escalation. Prior incidents established access; this campaign caused impact.

Immediate Actions for OT Operators

These actions address the confirmed exploitation vectors. Priority order reflects likelihood of direct exposure.

Priority 1: Unitronics Credential Audit (Complete This Week)

Inventory all Unitronics Vision Series controllers in your environment. Check asset management records and conduct a network scan if records are incomplete.
Log into each controller via Visilogic and verify the password has been changed from the factory default (1234 for operator access; 2 for configuration access on older firmware).
Change all default passwords immediately. Use passwords of at least 12 characters. Document the change in your maintenance log.
Verify internet exposure. Unitronics Vision Series controllers should not be directly accessible from the public internet. Confirm via Shodan or Censys that no controllers in your IP ranges appear in public scans on TCP port 20256 (Unitronics default).

# Shodan CLI — check for internet-exposed Unitronics in your IP ranges
shodan search "port:20256 product:Unitronics" --fields ip_str,port,org

# Alternatively, use Shodan web interface with query:
# port:20256 org:"[Your Organization Name]"

Priority 2: Rockwell/Allen-Bradley Network Isolation

CVE-2021-22681 requires network access to exploit. Network isolation reduces exposure even in the absence of a complete patch.

Verify firewall rules between IT and OT network zones. Rockwell PLCs should not have direct IP connectivity from corporate IT networks or the internet.
Implement CIP port filtering. CIP uses TCP 44818 and UDP 2222. Restrict these ports to authorised engineering workstations and HMI servers only.
Enable Rockwell’s CIP Security extension where firmware and hardware support it. CIP Security adds TLS-based authentication to CIP communications. Check controller firmware versions against Rockwell’s CIP Security compatibility matrix.

Priority 3: Implement CISA AA26-097A Detection Guidance

For Rockwell/Allen-Bradley environments:

Enable Logix project change logging. Configure Studio 5000 or your asset management platform to alert on unauthorised project downloads or routine modification.
Baseline your PLC programs. Export current Logix project files and store them in an integrity-protected location. Use hash-based comparison (SHA-256) to detect unauthorised changes.
Monitor CIP authentication events for unexpected access attempts, especially outside of authorised maintenance windows.

For Unitronics environments:

Enable the Unitronics audit log in Visilogic configuration (Operations → Remote Access → Audit Log). Review logs for unexpected login attempts or configuration changes.
Set up alerting on communication with Unitronics controllers from unexpected source IPs.

Priority 4: Validate Manual Operations Capability

Braham’s water plant went offline. If your SCADA system or PLC access is disrupted, how long can your facility maintain safe operations manually?

Identify which treatment processes can run under manual control and which require digital system access.
Verify that manual setpoint procedures are documented and that on-shift operators know where to find them.
Test manual operation procedures — not just review them. Many utilities have runbooks that have never been executed in a drill context.

Detection Queries

Network — Connections to Unitronics Management Ports

// KQL — Unitronics management port access from unexpected sources
DeviceNetworkEvents
| where RemotePort in (20256, 20257)
| where RemoteIPType != "Private" or 
        InitiatingProcessRemoteIP !in (known_engineering_workstation_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, 
          InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

// Splunk — Unitronics port connections from non-approved IPs
index=network_traffic dest_port IN (20256, 20257)
| where NOT src_ip IN (approved_engineering_ips)
| stats count BY src_ip, dest_ip, dest_port, _time
| where count > 0

Network — CIP Authentication Anomalies (Rockwell)

// KQL — CIP port access outside maintenance windows
DeviceNetworkEvents
| where RemotePort in (44818, 2222)
| extend HourOfDay = hourofday(Timestamp)
| where HourOfDay !between (6..18)  // Outside business hours — adjust to your window
| where RemoteIPType == "Private"
| summarize ConnectionCount = count(), Sources = make_set(DeviceName) 
            by RemoteIP, bin(Timestamp, 1h)
| where ConnectionCount > 3

Endpoint — Unexpected PLC Software Execution

// KQL — PLC engineering software launched from unexpected accounts
DeviceProcessEvents
| where ProcessCommandLine has_any ("Visilogic", "Studio 5000", "RSLogix", "FactoryTalk")
| where AccountName !in (approved_engineering_accounts)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName