/01What happened
Attackers broke into a remote login system for the industrial software that lets Muleshoe’s operators interact with a water tank, and manipulated it. The tank overflowed for about 30 to 45 minutes before officials took the system offline and switched to manual operation. The city said its water disinfection system was not affected. Afterwards it replaced the hacked software and took other steps to secure its network.
On January 18, a group calling itself CyberArmyofRussia_Reborn posted a video to Telegram that purported to show the manipulation of Muleshoe’s water valves. In April, Mandiant reported links between that persona and Sandworm, a sabotage unit of Russia’s GRU, but said it was unclear whether the GRU was behind the Muleshoe attack. The FBI investigated.
/02Two nearby towns
Hale Center, a town of about 2,000, saw some 37,000 attempts to log into its firewall in four days. Officials unplugged the system, ran it manually and disabled remote SCADA access. In Lockney, home to about 1,500 people, officials detected suspicious activity on a SCADA system and stopped the attackers before they reached the town’s water system.
/03Why remote access is the weak point
Small systems depend on remote access. Operators check tanks and wells from home, and vendors support equipment from hundreds of miles away. Each of those connections is a door, and too often it is a login page on the internet with a shared account, no multi-factor authentication, and no record of who used it.
/04Three lessons
- Treat remote access as the front doorBroker every remote session through a gateway with multi-factor authentication and logging, use named accounts, and turn vendor access on only when it is needed.
- Watch for abnormal commandsA tank filling past its high level, or valves moving outside normal patterns, should alert someone in seconds, not after the overflow.
- Be ready to run manualMuleshoe and Hale Center limited the damage by switching to manual quickly. Write the procedure down and practice it.
/05What to check this week
- List every remote access path to your control systems: vendor portals, remote desktop, HMI web servers and cellular modems.
- Require multi-factor authentication on each one, and remove shared accounts.
- Turn on session logging, and review who connected and when.
- Disable vendor access when it is not in use.
- Confirm the high-level and low-level alarms on every tank reach a person who will act on them.
- Run a manual operation drill at one remote site.
/06How we help
Culper-I‘s access management gives operators and vendors a secure, logged path into the control network, with multi-factor authentication and named accounts. Its monitoring alerts our SOC to abnormal commands, such as a valve or pump command outside normal patterns, and our analysts call your operator while there is still time to act. The result is water and wastewater compliance. See the rules it covers.
