CISA: attacks on water treatment systems knocked out more than 30 facilities in Minnesota

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency warning about a significant increase in attacks on programmable logic controllers (PLCs) in the water and wastewater sector that remain directly accessible from the internet.

The trigger was a wave of incidents in Minnesota: according to CISA, beginning last Sunday and continuing through Monday, attackers disrupted the operation of more than 30 municipal water systems. Minnesota IT Services (MNIT) activated its cyber incident response plan, describing what happened as a “coordinated cyberattack on operational technology.” A number of municipalities reported equipment failures that forced some facilities to temporarily switch to manual control.

What the attackers do

As CISA describes it, the attackers are targeting internet-exposed PLCs and changing passwords to lock out operators, as well as altering IP addresses to disconnect devices from the internet. Organizations of any size are at risk, including those with mature cybersecurity programs. Particular attention is drawn to the problem of undocumented cellular modems installed by operators, vendors or integrators — these often become an unnoticed point of entry.

The agency strongly recommends removing PLCs and other operational technology (OT) equipment from direct internet access as soon as possible. Where that isn't feasible, VPNs or gateways should be used for secure access, default passwords should be changed, and access should be restricted with an IP whitelist. For owners of Rockwell Automation MicroLogix 1400 controllers, CISA pointed to the vendor's instructions for restoring access after a password change.

The scale of the exposure

Censys, a company specializing in internet asset discovery, assessed the scale of the problem: more than 4,100 Rockwell Automation / Allen-Bradley hosts are currently reachable online, along with the same number of Siemens devices and over 2,000 Schneider Electric hosts. That said, Censys stresses that these are devices reachable from the public network, not necessarily compromised ones.

Many of the MicroLogix 1400 controllers mentioned in CISA's bulletin run firmware whose support has reached end-of-sale (EoS). Nearly half of the exposed Rockwell devices are accessible through carrier networks — Verizon Business, AT&T, T-Mobile, Comcast, Charter and Starlink — underscoring the severity of the “shadow” modem problem. Censys has also published an expanded set of indicators of compromise along with threat-hunting recommendations.

Source: Bleeping Computer