/01What happened
On Saturday, November 25, 2023, a PLC at one of the authority’s booster stations, which monitors and regulates pressure for Raccoon and Potter townships, was compromised. Its screen showed a message from a group calling itself CyberAv3ngers, declaring Israeli-made equipment a target. The station raised an alarm, and the authority took the system offline and ran it manually. It said there was no known risk to drinking water.
On November 28, CISA reported that the attackers had likely exploited poor password security and the device’s exposure to the internet. On December 1, a joint advisory from the FBI, CISA, NSA, EPA and Israel’s National Cyber Directorate said actors affiliated with Iran’s Islamic Revolutionary Guard Corps had compromised Unitronics PLCs at multiple U.S. water and wastewater facilities.
/02How the attackers got in
The Unitronics PLC was reachable from the open internet. The attackers found devices like it by probing for TCP port 20256, which Unitronics PLCs use, and confirmed them with protocol-specific scripts. CISA’s guidance told owners to make sure the factory default password, 1111, was not in use.
/03The three controls that would have stopped it
- Take it off the internetPut the PLC behind a firewall, VPN or secure gateway, and allow only known addresses. Nothing in a control system should answer to the open internet.
- Change default passwordsReplace every default password on PLCs and HMIs with a strong, unique one.
- Require MFA for remote accessIf anyone needs to reach the control network remotely, make them pass multi-factor authentication at the gateway, even when the PLC itself cannot support it.
CISA also advised backing up PLC logic and configurations for fast recovery, moving off the default port where possible, and updating PLCs and HMIs to current firmware.
/04The lesson for small utilities
Aliquippa did not take a sophisticated attack. It took a controller that answered to the internet with weak password security. Vendor-installed remote access, set-and-forget controllers and no inventory are common at small systems, and they are exactly what scans for exposed devices find first.
/05What to check this week
- Look for control devices exposed on your public IP addresses, or ask CISA for its free vulnerability scanning service.
- Change every default password on PLCs and HMIs.
- Put a firewall or secure gateway in front of anything that must be reached remotely, and require multi-factor authentication.
- Back up PLC logic and configurations, and learn the restore process.
- Update PLC and HMI firmware.
- Make sure operators can run each station in manual, and practice it.
/06How we help
Culper-I finds exposed controllers and default credentials as part of its inventory, alerts our SOC to any change in PLC logic or configuration, and gives vendors a secure, logged path for the remote support they already provide. The result is water and wastewater compliance. See the rules it covers.
