Executive Summary

Water and wastewater systems have become favored gray-zone targets because they are highly vulnerable and hold disproportionate strategic value. The combination of chronic underinvestment and weak baseline operational technology (OT) security make many of these critical systems easy to compromise. Such intrusions can have both physical and psychological impact, and disruptions often affect civilian life, public health, and trust in government. 

Recent nation-state cyber activity targeting water systems includes Iranian IRGC-linked targeting of exposed programmable logic controllers (PLCs), Russian and pro-Russian access to municipal water-control environments, and PRC-linked pre-positioning in U.S. critical infrastructure, including water and wastewater systems. U.S. federal agencies, including CISA, FBI, NSA, and EPA, have warned that many utilities remain exposed through internet-facing human-machine interfaces (HMIs) and PLCs, weak credentials, shared accounts, legacy devices, limited monitoring, and poor IT/OT segmentation.

Operations targeting water systems fit a modern hybrid warfare doctrine that has become increasingly dominant in recent years. Russia, China, and Iran all use cyber access primarily as a shaping tool, not a destructive weapon. Water-system access specifically can create fear, test response thresholds, consume emergency resources, and provide leverage during crises. Each nation puts their unique twist on their operations. Russia tends to pair infrastructure access with pressure and destabilization. Iran often blends symbolic retaliation, psychological signaling, and opportunistic disruption. In contrast, China places more emphasis on long-term pre-positioning and strategic persistence. 

All three models converge on the same underlying thesis: targeting civilian utilities provides strategic options.

Water Systems as Pre-War Terrain

From 2024 to 2026, water-sector targeting moved from opportunistic nuisance activity to a feature of state competition. Water systems are now pressure points used to create fear, test resilience, and prepare options before wider conflict. Specifically, threat actors have exploited internet-exposed PLCs and weak credentials to deface HMIs and make public spectacles out of their compromises.

Iran uses successful compromise of water systems for visible signaling, retaliation narratives, and propaganda, while Russia uses it for disruption, intimidation, and hybrid pressure against NATO-aligned states. Meanwhile, China focuses on quiet persistence, reconnaissance, and contingency access inside U.S. critical infrastructure. However, all of these operations are meant to serve the same purpose: setting the stage for war without crossing the threshold into open conflict.

Iran: CyberAv3ngers / IRGC-Linked PLC Targeting

Iran-linked activity has been the most direct in targeting water and wastewater systems.In April 2020, Iranian state-sponsored hackers launched a cyberattack targeting Israeli water and wastewater control systems. While this attack attempted to manipulate the SCADA systems, automated systems kicked in and thwarted the attempt. Had it succeeded, during a heat wave, it could have harmed many people. 

In December 2024, CISA reported that the IRGC-affiliated CyberAv3ngers targeted and compromised Israeli-made Unitronics Vision Series PLCs used across multiple sectors, including U.S. water and wastewater systems. The activity exploited poor authentication and exposed PLC/HMI interfaces rather than sophisticated malware delivery. Clearly this shows that the Iranian government is accustomed to the idea of attacking public infrastructure, something usually outside the bounds of conventional warfare.

In April 2026, CISA, FBI, NSA, EPA, and partner agencies issued a new advisory warning that Iranian-affiliated cyber actors were exploiting internet-facing PLCs across critical infrastructure, including water, wastewater, energy, and government facilities. The EPA separately framed the advisory as a water-sector resilience warning, stressing that national security depends on water systems reporting incidents and hardening exposed OT assets.

Assessment: While Iran has demonstrated the ability to access exposed control devices, deface HMIs, and create public fear, the public evidence of their activity still points more toward opportunistic OT access than reliable cyber-physical sabotage at scale.

Primary TTPs

Russia: Pro-Russian Hacktivist and Sandworm-Adjacent Water Disruption

Russia-aligned actors have shown a willingness to use their access to manipulate water-control systems directly. In Mulshoe, Texas in January 2024, attackers accessed a remote industrial interface and caused a municipal water tank to overflow for roughly 30–45 minutes. The Cyber Army of Russia Reborn claimed responsibility, and Mandiant linked the group to Sandworm, Russia’s GRU-associated destructive cyber unit.

A little over a year later, in April 2025, attackers seized control of a dam in Bremanger, Norway. They opened a floodgate, releasing roughly 500 liters of water per second for four hours before the incident was stopped. Norway’s counterintelligence chief publicly blamed Russia-linked actors for the intrusion.

Assessment: Russian-linked activity is more sabotage-oriented than Iranian activity. The pattern fits Moscow’s broader hybrid campaign: low-cost disruptive access, public fear generation, and probing of Western infrastructure resilience. 

Primary TTPs

China: Volt Typhoon Pre-Positioning in Water and Wastewater Networks

In February 2024, CISA, NSA, FBI, and allied agencies confirmed that Volt Typhoon had compromised IT environments across multiple U.S. critical infrastructure sectors, including water and wastewater, communications, energy, and transportation. The advisory assessed that the activity was intended to enable disruptive or destructive effects during a future crisis or kinetic conflict.

The same year, the EPA distributed an alert to more than 60,000 water and wastewater systems regarding Volt Typhoon and coordinated cybersecurity assistance for water infrastructure supporting U.S. defense-critical facilities.

Assessment: PRC water-sector targeting is strategically different from Iran and Russia. Rather than demonstrate immediate effects, Volt Typhoon’s  objective is durable access, reconnaissance, and strategic pre-positioning. 

Primary TTPs

‍

Poland and European Water-System Exposure

A May 2026 report released by the Polish Intelligence Service stated that hackers breached five Polish water treatment plants in 2025. The threat actors leveraged weak/default passwords and internet-exposed control systems. Once inside  ICS controlling pumps and filters, they had the ability to alter chemical-dosing parameters. The attacks were never attributed to a specific nation-state or threat actor; however, the same intelligence report alluded to prior Russian and Belarusian hybrid operations against Polish infrastructure.

Assessment: Poland is a high-priority target because of its role as a NATO logistics hub for Ukraine. Even unattributed water-system intrusions in Poland should be assessed against Russian hybrid-warfare objectives: intimidation, disruption, reconnaissance, and resilience testing.

‍

Major Non-Attributed Water-Sector Incidents Relevant to State Threat Modeling

American Water disclosed a cyber incident in October 2024 that affected customer-facing and billing systems, but not water or wastewater operations. Veolia North America reported a January 2024 ransomware incident that disrupted back-end systems and online bill payment, while treatment operations remained unaffected. Southern Water in the United Kingdom was also claimed by Black Basta, with customer and employee data at risk but no reported operational impact.

Other cases moved closer to operational risk. Arkansas City, Kansas shifted its water treatment facility to manual operations after a September 2024 cyber incident. Minot, North Dakota did the same in March 2026 after ransomware affected a server tied to the water treatment environment. In both cases, water remained safe, but operators had to rely on fallback procedures.

These incidents matter because they show that state actors do not need custom ICS malware to create risk. Billing systems, customer portals, GIS repositories, vendor access, remote administration, identity systems, backups, and SCADA-adjacent servers can all provide useful access or intelligence. Criminal and unattributed incidents should therefore be treated as live demonstrations of the same weaknesses a state actor could exploit with more patience, planning, and operational intent.
‍

Common Vulnerabilities Exploited Across Cases

Water-sector targeting repeatedly converges on the same weaknesses: 

• Internet-facing HMIs and PLCs, 
• Weak or default credentials, 
• Exposed remote-access tools, 
• Shared operator accounts, 
• Unsupported legacy systems, 
• Limited monitoring,
• Poor segmentation between IT and OT networks. 

These gaps give actors simple access paths into systems that control pumps, valves, filters, chemical dosing, and alarms.

Reporting from the EPA and Government Accountability Office (GAO) shows that this is a systemic risk, not a one-off failure. The U.S. water sector includes roughly 170,000 water and wastewater systems, many of which operate with limited resources, voluntary security adoption, and uneven cyber maturity. This structure makes the sector easy to probe, difficult to standardize, and attractive to state and state-aligned actors seeking leverage, visibility, and disruption opportunities.

‍

Strategic Assessment

The last two years show clear segmentation among state-sponsored and state-aligned actors. Iran uses water system intrusions to maximize ideological and psychological impact. Russia treats water and dam systems as part of sabotage-oriented hybrid warfare. China targets water infrastructure for strategic pre-positioning.

The near-term risk is not a Stuxnet-class attack. It is a low-complexity compromise of exposed OT that causes local disruption, unsafe operations, or panic. The larger strategic risk is quiet PRC-style persistence inside water-sector IT and OT-adjacent networks that could be used during a geopolitical crisis, such as kinetic conflict between the U.S. and China over Taiwan.
‍

Conclusion

State and state-aligned actors treat water and wastewater infrastructure as strategic pressure points. The value is primarily psychological and political rather than kinetic. Even limited access or brief disruptions can trigger disproportionate reactions because water is tied directly to public health, trust, and government competence.

The most likely future is not a catastrophic “cyber Pearl Harbor.” It is persistent low-level access, intermittent disruption, coercive signaling, information operations, and pre-positioning for broader confrontations. 

‍

Appendix A: Indicators of Compromise and Detection Artifacts

Iran: CyberAv3ngers / Iranian-Affiliated PLC Targeting

CISA, FBI, NSA, EPA, DOE, and U.S. Cyber Command reported that Iranian-affiliated actors used overseas infrastructure to access internet-facing Rockwell Automation / Allen-Bradley PLCs, including CompactLogix and Micro850 devices, and that activity resulted in project-file extraction, HMI / SCADA data manipulation, operational disruption, and financial loss. (Internet Crime Complaint Center)

Iran: Ports, Devices, and Tools

The April 2026 joint advisory specifically called out malicious traffic to ports 44818, 2222, 102, 22, and 502, and noted Dropbear SSH deployment for remote access. (Internet Crime Complaint Center)

Iran: 2023 Unitronics / CyberAv3ngers Artifacts

The earlier joint advisory reported IRGC-affiliated CyberAv3ngers targeting Unitronics Vision Series PLCs, commonly used in U.S. water and wastewater systems, and compromising devices using default credentials.

Russia: Cyber Army of Russia Reborn / Sandworm-Adjacent Activity

Mandiant linked CARR to Sandworm-associated infrastructure and personas, while Treasury reported that CARR claimed responsibility for overflowing water storage tanks in Abernathy and Muleshoe, Texas, and posted video of HMI manipulation. (CyberScoop)

Norway and Poland Exposure Artifacts

Reuters reported that Norway’s counterintelligence chief blamed Russian hackers for the April 2025 Bremanger dam incident. TNW and SecurityWeek reported that Polish water treatment plant breaches involved weak passwords and internet-exposed control systems; attribution remains unconfirmed for those Polish incidents. (Reuters)

China: Volt Typhoon Behavioral IOCs

NSA and partner agencies reported Volt Typhoon’s living-off-the-land model using built-in tools including wmic, ntdsutil, netsh, and PowerShell; the same advisory included examples of ntds.dit extraction, registry hive collection, and portproxy abuse.

Appendix B: MITRE ATT&CK Mapping

The Iran rows are directly mapped from AA26-097A’s ATT&CK tables; the Volt Typhoon rows are mapped from NSA/CISA/FBI partner reporting on living-off-the-land activity; the Russia and Poland rows are analytic mappings based on public incident descriptions and should be treated as lower-confidence than the official advisory mappings. (Internet Crime Complaint Center)

‍