As reported by SecurityAffairs, Iranian-linked hackers have expanded their ongoing campaign against U.S. water infrastructure, with confirmed attacks now spanning at least 12 states — most recently targeting facilities in New Jersey and Alabama. While the immediate operational disruption appears limited, this breadth of targeting demands serious strategic attention from both utility operators and federal agencies.

Threat Intelligence: As reported by SecurityAffairs, Iranian-linked hackers have expanded their ongoing campaign against U.S.

Why This Campaign Is More Alarming Than It Looks

Limited disruption is not the same as limited risk. Iranian threat actors — likely operating under or adjacent to groups with IRGC affiliations — have demonstrated a clear and sustained interest in U.S. critical infrastructure. The fact that 12 states have been touched since late July is not a sign of opportunistic scanning; it reflects a deliberate, methodical reconnaissance and intrusion campaign. What we are likely observing is the reconnaissance and persistence phase of a longer-term operation, not the endgame.

Water utilities are among the most vulnerable segments of U.S. critical infrastructure for several structural reasons:
Why This Campaign Is More Alarming Than It Looks
Legacy OT/ICS environments: Many systems run SCADA platforms and PLCs that are decades old, with minimal patching cycles and no network segmentation from IT systems.
Understaffed security teams: Rural and mid-sized utilities frequently lack dedicated cybersecurity personnel, let alone 24/7 SOC coverage.
Internet-exposed HMIs: Human-machine interfaces for water treatment and distribution are frequently exposed to the internet, often protected only by default or weak credentials.
Slow regulatory pressure: Unlike financial services or healthcare, water utilities have faced comparatively limited mandatory cybersecurity standards, though EPA and CISA have accelerated guidance post-2023.

Who Is Behind This and What Do They Want?

Attribution points toward Iranian state-aligned actors with a history of targeting water and energy infrastructure — a tactic consistent with Iran's broader hybrid warfare doctrine. The strategic objective is almost certainly pre-positioning: establishing footholds that could be activated during periods of geopolitical escalation. This mirrors patterns observed in Chinese APT activity against U.S. power grids (Volt Typhoon), where the goal is deterrence and leverage rather than immediate destruction.

"Limited disruption today does not mean limited intent. Nation-state actors invest in access years before they intend to use it."

The campaign also serves an intelligence-gathering function — mapping the operational architecture of U.S. water systems, understanding manual override capabilities, and identifying which facilities lack the detection tools to notice intrusions at all.

Systemic Gaps the Water Sector Must Address

Most water utilities responding to these intrusions are likely doing so reactively — after detection, after media exposure, or after being notified by CISA or the FBI. The sector as a whole lacks:

  • Baseline OT-specific threat detection and monitoring (solutions like Claroty, Dragos, or Nozomi are underdeployed in municipal water)
  • Incident response plans tested specifically against ICS/SCADA scenarios
  • Network segmentation between IT business systems and OT control networks
  • Multi-factor authentication on remote access points and HMI portals
  • Inventories of internet-exposed assets and third-party vendor connections

Shield53 Recommendations

Immediate Actions for Water Utilities

  • Audit internet-facing assets immediately. Use tools like Shodan or CISA's free scanning services to identify exposed HMIs, remote desktop services, and VNC instances. Eliminate unnecessary exposure now.
  • Enforce MFA on all remote access. No exceptions — VPNs, RDP gateways, and vendor remote access portals must require multi-factor authentication.
  • Change default and shared credentials. Conduct a full credential audit across OT systems, PLCs, and control panels. Default passwords on water sector OT devices remain a primary initial access vector.
  • Segment IT from OT networks. Even basic firewall segmentation between corporate IT and operational technology networks dramatically reduces lateral movement risk.
  • Engage CISA's free services. CISA offers no-cost vulnerability scanning, cyber hygiene assessments, and incident response support specifically for water sector entities. There is no reason not to engage them.
  • Review and test your incident response plan. Specifically tabletop an OT/ICS intrusion scenario — what happens if a threat actor manipulates chemical dosing controls or shuts down pumping stations?
  • Report suspicious activity immediately. Contact CISA (1-888-282-0870) and FBI's local field office. Threat intelligence sharing helps protect neighboring utilities.

For State and Federal Policymakers

This campaign reinforces the urgent need for mandatory minimum cybersecurity standards for water utilities — not voluntary guidance. The EPA's repeated attempts to institute baseline requirements have faced legal challenges, but the threat landscape no longer permits a voluntary-only posture. Funding mechanisms like the Drinking Water State Revolving Fund should explicitly prioritize cybersecurity investments at under-resourced utilities.

The Broader Implication

The water sector is the canary in the coal mine for U.S. critical infrastructure vulnerability. If Iranian actors — not the most technically sophisticated nation-state threat — can successfully intrude into water systems across 12 states, the implications for more capable adversaries are sobering. Defenders across all critical infrastructure sectors should treat this campaign as a benchmark: if your sector's security posture is comparable to the average water utility, you are exposed.