Iran's cyberwarfare against US drinking and wastewater facilities - I'mTech

Iran’s cyberwarfare against US drinking and wastewater treatment facilities in at least 12 US states in late July was an exceptional success, with more attacks underway.

Iran’s cyberwarfare targets water treatment OT (operational technology) systems via internet-connected PLCs (process logic controllers). It was, and still is, standard procedure to use the internet (or mobile data) to connect thousands of remote PLCs to the SCADA systems (Supervisory Control and Data Acquisition).

The Internet alternative is to build private networks (vastly expensive and sometimes impossible to run private cable) or implement VPNs (virtual private networks) and strict IP allowlisting (still hackable).

It seems this attack was more a proof of concept to test Iran’s cyberwarfare capabilities. They managed to modify passwords, lock out operators, and disconnect the PLCs. In effect, they had complete control of water treatment. This resulted in untreated water/sewerage and huge cost increases, as operators had to manually control their operations.

CISA (Cybersecurity and Infrastructure Security Agency) says that even water organisations with mature cybersecurity processes must validate all devices that connect directly or indirectly to the internet, including those using cellular modems installed by operators, vendors, or system integrators.

The internet (or mobile internet) is simply the attack vector. The vulnerable PLCs are used globally and extensively in water treatment, transport, and other utilities like power generation and distribution.

They are also used for:

You likely have several consumer-grade PLCs in your – thermostats, solar inverters, gate openers, garage door openers, etc.

The weakness is that cyberwarfare hackers using AIBots can access millions, if not billions, of vulnerable PLCs over the internet, allowing them to take control. Replacing vulnerable and legacy PLCs would bankrupt most countries.

Iran’s cyberwarfare uses advanced AIBots (likely from China) to look for and exploit unpatched PLC CVEs (Common Vulnerabilities and Exposures) to wreak havoc against its US enemy.

They are successful because, like all IoT devices, they have a small brain and communication capabilities. Many are old and have no updated firmware, leaving manufacturer-installed backdoors there to access them in case of an emergency.

While most commercial PLCs are developed in Germany, Japan, Europe and the USA, many use Chinese factories or supply lines to manufacture them.

Most consumer and light industry PLCs are Chinese-made . “They deliver 90% of the functionality of Tier-1 Western PLCs at 40-60% of the price.”

They also largely a common Linux-like operating system and command environment, and it’s not hard to reprogram a PCL to do other tasks, like drop an elevator from the top floor!

These environments also introduce challenges that do not exist in ordinary corporate IT. Industrial systems can have long operational lifecycles. Some devices cannot simply be taken offline whenever a security team identifies a problem. Maintenance windows may be limited, operational availability can take priority and legacy equipment may depend on older protocols or configurations.

Australia is a prime target for Iran and Chinese state actors. More so as it exerts its influence on the world stage or secures more security alliances and defence partnerships.

In August, the Australian Cyber Security Centre (ACSC) issued a high-severity alert warning that it has observed active exploitation of a vulnerability affecting Australian-based TeamCity On-Premises servers and N-able N-central products .

On 19 August 2026, US government agencies warned Australia of an active threat targeting Siemens S7 Series programmable logic controllers via AI-generated exploitation scripts. The significance is speed: AI significantly shortens the gap between vulnerability research and usable attack tooling. This changes the economics of vulnerability exploitation.

More chilling, the warning states: “The warning does not describe a single new vulnerability that organisations can fix with one patch. Instead, it highlights an active threat involving AI and exposed or insufficiently protected PLCs”.

The ACSC said that in 2024-25 it responded to over 1,200 cybersecurity incidents, an 11% increase. “ACSC notified entities more than 1,700 times of potentially malicious cyber activity – an 83% increase from last year. State- cyber actors continue to pose a serious and growing threat to our nation. They target networks operated by Australian governments, critical infrastructure (CI), and businesses for state goals.”

It warned that it notified CI entities of potential malicious cyber activity over 190 times, up 111%. The top CI incident (55%) involved compromised assets, networks, or infrastructure.

“State- cyber actors routinely target Australia’s CI networks to conduct espionage or to pre-position for disruptive and destructive cyber effects in the event of crisis or conflict.

I thought this was relevant to readers as it reinforces the major consumer weakness of old and unpatched routers. Read: router vulnerabilities checker – do this updated Update your old router NOW – please .

It’s the same issue. AIBots are crawling the internet looking for weaknesses in routers, security cameras, TVs, and IoT devices. AI is relentless, does not take a break, literally costs nothing, and is solely focused on finding and exploiting weaknesses.

Several ‘infected’ router owners contacted me and were confused what to do and how fast they should act.

The answer is that you can still use the router, but the faster you replace it, the faster your internet speeds will be. Our Wi-Fi heat map service helped 12 readers to plan for whole-of- NBN using mesh systems. Read: Free NBN Router advice to get what you need .

Brought to you by im.com.au - I'mTech