Anoymask

Water OT Attack Targeting Public PLCs: Locking Out Operators via Password and IP Changes

1. Basic Information

Related Sources

2. Summary

An attack that disrupts water operations by changing management settings on PLCs directly exposed to the Internet, locking out operators with new passwords, and disconnecting devices by changing IP addresses.

3. Attack Flow

Tampering with Public PLC Settings

  1. Attackers search for PLCs exposed to the Internet or unknown cellular modems.
  2. They access default/weak credentials or exposed management interfaces.
  3. They change the PLC password and lock out legitimate operators.
  4. They change network configurations like the PLC IP address and disconnect it from remote monitoring and control.
  5. Water supply equipment stops or malfunctions while facilities shift to manual operation and local recovery.

4. Attacker Position and Execution Points

  • Attacker: Connects directly to the PLC/OT management surface from the Internet.
  • Execution Points: PLC firmware/configuration interface, cellular modem, remote access gateway.
  • Impact Scope: Water and wastewater treatment control equipment and monitoring stations.

5. Visibility for Victims and Administrators

Victims and Users

  • Cannot connect to the PLC from the operator console, passwords fail, IP addresses change, and assets disappear.
  • Physical operational anomalies such as pressure drops, equipment malfunctions, and switching to manual operation.

Administrators and SOCs

  • OT asset configuration changes, unexpected reboots/link losses, remote management sessions, and unknown cellular routes.
  • IT-side EDR is not visible; firewalls, PLC audits, and engineering workstation logs are the main evidence.

6. Success and Failure Conditions

Success Conditions

  • PLCs/OT are directly exposed to the Internet or exposed via unknown modems.
  • Default/weak/reused credentials and management interfaces with weak authentication.
  • Lack of source IP restrictions, VPNs, gateways, or MFA.
  • Insufficient configuration backups and local recovery procedures.

Failure Conditions

  • Removing PLCs from the Internet and restricting access to brokered remote access.
  • Enforcing unique passwords, IP allowlists, VPNs/gateways, and MFA.
  • Continuously auditing external exposures, including cellular and ISP lines.
  • Rapid recovery using configuration change alerts and offline backups.

7. What Happens Upon Success

  • Operator lockout and loss of remote control.
  • PLC network disconnection, equipment malfunction, and service disruption.
  • Transition to manual operation and physical safety risks on-site.
  • Potential physical damage depending on configuration tampering. However, this alert does not confirm physical damage in all cases.

8. Observable Logs

Email

  • No direct elements.

Proxy/SWG/DNS

  • May bypass standard IT proxies. Check remote access gateway/VPN logs.

Endpoint/EDR

  • Vendor tool execution and configuration uploads on engineering workstations. PLCs often lack EDR agents.

Identity/IdP

  • PLC/local account logins, password changes, failed logins, VPN/MFA, and vendor accounts.

SaaS/Cloud

  • OT remote management portals, cellular carrier portals, and managed integrator audits.

Network

  • Internet source connections to PLC protocols/HTTP, IP/MAC mismatches, ARP changes, link losses, config writes, and unexpected scanning.

9. Attack Success Determination

  • Contact Only: PLC port scan/management page access.
  • User Interaction: None.
  • Initial Execution: Management session established or configuration read.
  • Successful Authentication: Successful login and password change.
  • Data Theft / Session Compromise: Not the main objective of this incident. Configuration retrieval must be determined separately.
  • Subsequent Compromise: IP change, operator lockout, process disruption, and manual operation.

10. Investigation Playbook

  • Trigger: PLC offline status, password mismatch, IP change, process alarms, and external management connections occurring simultaneously.
  • Initial Check: Prioritize safety, and share facts between on-site operators and the SOC. Follow facility procedures for dangerous operations like power-offs.
  • Devices: Preserve engineering workstations, gateways, modems, and PLC configs/audits.
  • Authentication & Cloud: Rotate vendor/contractor/PLC/VPN credentials in a secure order.
  • Subsequent Operations: Investigate all sites with the same model/credentials/communication paths and search for unknown cellular modems.
  • Containment: Block public exposure, enforce IP allowlists/VPNs, restore configurations from trusted backups, and verify local controls.
  • Judgment Categories: Internet Exposure / Unauthorized Login / Config Change / Operator Lockout / Process Impact.

11. Defense and Detection Ideas

  • Single Events: PLC password/IP changes, unknown remote logins, new cellular paths.
  • Correlations: External scan -> Admin login -> Credential change -> IP change -> Telemetry loss/process alarm.
  • Hunting: Cross-reference external views (like Censys) with asset inventories, prioritizing End-of-Support (EoS) firmware and default credentials.
  • Log Shortages: PLC audits, serial/engineering protocol captures, carrier NAT, vendor remote access, and time synchronization.
  • Priority Countermeasures: Remove devices from the Internet, use unique credentials, implement VPN/MFA/allowlists, maintain configuration backups, and conduct OT incident drills.

12. Facts / Inference / Hypothesis

Facts

  • CISA warned of increased activity targeting Internet-exposed PLCs.
  • Observed behaviors include operator lockout via password changes and disconnection via IP changes.
  • Organizations with mature security programs, both large and small, have been targeted.
  • Exposed OT systems may include undocumented cellular modems installed by operators, vendors, or integrators.
  • Reports indicate over 30 community water systems in Minnesota were affected, with some transitioning to manual operation.

Inference

  • Similar exposure risks exist in utility PLCs for water systems, factory utilities, and building facilities globally.
  • IT SOCs alone cannot judge process impacts; joint severity criteria with OT operators are required.

Hypothesis

  • If shared passwords or integrator remote accesses are used across multiple sites, incidents can scale into cross-regional simultaneous disruptions.

13. MITRE ATT&CK Mapping

  • T0883 – Internet Accessible Device (Confidence: High (ICS))
  • T0859 – Valid Accounts (Confidence: Medium)
  • T0836 – Modify Parameter (Confidence: High)
  • T0814 – Denial of Service (Confidence: High)
  • T0826 – Loss of Availability (Confidence: High)
  • T0830 – Man in the Middle (Confidence: Low - Not confirmed in this case)

14. Unknowns and Additional Investigations

  • Initial access methods and credential types for each site.
  • All targeted PLC models and firmware versions.
  • Attribution and shared infrastructure.
  • Similar incidents in other regions.
  • Exact impacts on physical processes and recovery times.

15. Impact on SOCs and General Organizations

Utility PLCs in factories, hospitals, and buildings share the same exposure structure as water systems. Organizations, contractors, and equipment vendors must clearly define asset inventories, remote access controls, log preservation, and recovery responsibilities, while expanding external exposure investigations to include cellular lines.

16. Summary by Role

For SOCs

Do not treat PLC offline events simply as network issues. Correlate them with preceding remote logins, password/IP changes, and process alarms.

For Administrators

Remove PLCs from the Internet, implement VPNs/MFA/allowlists, enforce unique passwords, maintain offline configuration backups, and inventory cellular connections.

For Users

Do not operate systems based on personal judgment when water quality, pressure, or equipment anomalies occur. Follow on-site procedures and immediately contact operations management.