Hackers Exploit Weak Credentials and Internet-Facing PLCs to Breach Water Utilities

Nation-state actors and affiliated groups (Iranian CyberAv3ngers, Russia-linked Sandworm/Cyber Army of Russia Reborn, and China’s Volt Typhoon) have been exploiting internet-facing PLCs, weak/default credentials, exposed remote access, and poor IT/OT segmentation to access and, in some cases, disrupt water and wastewater systems across the United States and Europe between 2024–2026; the report provides incident examples (municipal tank overflow, dam floodgate release), enumerates TTPs and IoCs (IPs, ports, tools, file artifacts), and recommends immediate mitigations such as removing ICS devices from direct internet access, enforcing MFA, improving OT monitoring, and segregating IT/OT networks.