Iran-Linked Actors Hit 30+ Minnesota Water Utilities via Internet-Exposed PLCs; CISA Issues Emergency Alert

A coordinated cyberattack disrupted OT systems across more than 30 Minnesota community water systems on July 26–27, with threat actors targeting internet-exposed PLCs to change passwords and modify IP addresses — locking out operators and forcing manual operations and boil-water notices. Federal investigators are probing a possible Iran connection aligned with CISA Advisory AA26-097A, which was updated July 22 to expand scope to Schneider Electric and Siemens devices alongside Rockwell Automation PLCs and to document a new project-file exfiltration tactic. CISA's acting director issued an emergency call for all water utilities to immediately remove PLCs and OT from internet exposure, warning that nearly half of exposed Rockwell devices are reachable via cellular modems representing a critical blind spot.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the critical severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.