State Actors Target Water Systems Amid Weak Cyber Defenses

• •Russia, China, and Iran are targeting water systems due to weak cybersecurity defenses.
• •Iranian and Russian actors employ different tactics: disruption versus long-term access.
• •Recent ransomware incidents have forced utilities to operate manually, indicating sector vulnerability.

Water and wastewater systems are increasingly targeted by Russia, China, and Iran due to poor operational technology defenses. Exposed human-machine interfaces and programmable logic controllers create vulnerabilities that can be exploited for disruption. U.S. agencies have noted a shift towards state-aligned cyber campaigns, with Iran-linked groups using weak authentication to deface systems, while Russian actors have manipulated municipal water systems to create physical disruptions. China's strategy focuses on long-term access to critical infrastructure for future leverage. Recent ransomware incidents have further highlighted the sector's fragility, forcing utilities to revert to manual operations. The situation is exacerbated by chronic underinvestment in cybersecurity measures.