Over the weekend of July 26–27, 2026, someone reached into the control systems of water and wastewater utilities in more than 30 Minnesota communities at roughly the same time. In Braham, a town of about 1,700 people, the well and the water treatment plant went dark; operators brought them back manually inside two hours. Maple Plain declared a local state of emergency. Plymouth, a suburb of roughly 80,000, physically disconnected the cellular equipment mounted on its water towers and wastewater lift stations. South St. Paul lost automated control of its water utility and fell back to running it by hand.

No boil-water advisory was issued anywhere in the state. The Minnesota Department of Health confirmed water quality was unaffected at every system hit. That outcome is worth stating plainly up front, because it is the only reassuring fact in this story — and it held because human operators were standing next to the equipment, not because the defenses worked.

What Was Actually Attacked

The intrusions did not touch treatment chemistry. They hit the layer above it: the programmable logic controllers, remote telemetry units, and cellular backhaul that automate pumps, valves, tank levels, and lift stations across geographically scattered sites.

That distinction matters. Small municipal water systems run dozens of unstaffed remote assets — a well house here, a booster station there, a lift station on the edge of town — tied back to a SCADA head end over cellular modems, because trenching fiber to a wellfield serving 1,700 people has never penciled out. Every one of those cellular links is a potential front door, and the utilities that depend on them are precisely the ones with no OT security staff, no 24/7 monitoring, and a budget cycle measured against pipe replacement rather than firewalls.

Attack more than 30 of them in a weekend and you are not compromising 30 networks. You are compromising one class of exposed device, 30 times.

The Flaw With No Patch

The vulnerability at the center of federal warnings is CVE-2021-22681, an authentication bypass in Rockwell Automation Logix controllers carrying a CVSS score of 9.8. It is five years old and there is no patch — and there will not be one.

The flaw is architectural. Rockwell’s engineering software and its controllers share a cryptographic key that is embedded in the software itself. Extract that key, and you can authenticate to the controller as though you were the engineering workstation: download logic, upload modified logic, change the controller’s operating mode. Rotating the key would break the installed base. Remediation is therefore not a patch but a set of compensating controls — get the controller off the internet, set the physical mode switch to RUN, segment the network, and monitor for logic changes.

CISA added CVE-2021-22681 to the Known Exploited Vulnerabilities catalog in March 2026, following confirmed exploitation by Iranian-affiliated actors. Two related Rockwell flaws sit alongside it in the same threat picture: CVE-2023-3595 (CVSS 9.8, remote code execution in ControlLogix 1756 communication modules) and CVE-2024-6242 (CVSS 8.4, a Trusted Slot bypass in ControlLogix).

Four Days’ Warning

On July 22, 2026 — four days before the Minnesota attacks began — CISA updated advisory AA26-097A, originally published April 7, which documented Iranian-affiliated exploitation of internet-exposed Rockwell PLCs across the water, government, and energy sectors.

The July 22 update did three things. It expanded the manufacturer scope beyond Rockwell to include Schneider Electric (BMX P34 / Modicon M340) and Siemens (S7-1200) devices. It documented project file exfiltration through vendor engineering software — meaning the actors are stealing the control logic itself, which is reconnaissance for a far more precise second act. And it added detection guidance for manipulated Add-On Instructions, the reusable logic blocks that, if quietly rewritten, can disable safety interlocks while the HMI keeps showing green.

Four days later, more than 30 Minnesota utilities lost automated control.

Attribution: Consistent With, Not Confirmed

Federal officials have not publicly attributed the Minnesota attacks. What has been said, and what independent researchers have assessed, is that the operational pattern is consistent with the CyberAv3ngers threat ecosystem.

CyberAv3ngers is a state-directed group operating under Iran’s IRGC Cyber-Electronic Command, sanctioned by the US Treasury in February 2024. Its trajectory is well documented and it escalates:

  • 2023 — default-credential attacks against Unitronics PLCs, chosen because they were Israeli-made, hitting US water utilities including Aliquippa, Pennsylvania
  • 2024 — deployment of IOCONTROL, a purpose-built ICS malware platform
  • 2026 — active exploitation of CVE-2021-22681 across US water, energy, and government facilities

The signature elements line up: small utilities rather than large metros, cellular-connected remote equipment, disruption of automation rather than manipulation of process safety, and timing keyed to a freshly published advisory. Analysts at Tenable’s Research Special Operations team reached the same assessment on pattern grounds.

The geopolitical context is not incidental. The United States and Iran have been in open armed conflict since Operation Epic Fury commenced on February 28, 2026. Attacks on US municipal water infrastructure by an IRGC-directed unit are not opportunistic crime. They are signalling.

The Exposure Is National

Censys counted 5,219 internet-exposed industrial protocol hosts globally. 3,891 of them are in the United States — 74.6% of the world’s total exposure, concentrated in a country whose water sector consists of roughly 50,000 community systems, most of them serving under 10,000 people.

Minnesota was not singled out for anything but convenience. There is nothing about a Minnesota well house that is more reachable than one in Ohio, Texas, or Oregon. The same equipment, the same cellular modems, and the same unpatchable controller flaw are deployed across every state.

What Operators Should Do This Week

The mitigations are unglamorous and they are all available today:

  • Disconnect PLCs from the public internet. Not firewall them — disconnect them. Every device in that Censys count is a device someone believed was fine behind a cellular APN.
  • Set physical mode switches to RUN. A controller in RUN mode cannot accept a logic download regardless of what the authentication layer does. This defeats CVE-2021-22681 outright and costs nothing but a site visit.
  • Audit every cellular connection. Inventory the modems, confirm which carrier APNs are private, and kill any public-addressable ones.
  • Segment IT from OT. Flat networks turn a phished email into a pump failure.
  • Deploy the CISA indicators from AA26-097A, and specifically hunt for modified Add-On Instructions and unexplained project file access.
  • Keep offline PLC backups of known-good logic, and verify you can actually restore from them.

Braham recovered in two hours because staff could run the plant by hand. That is a real control, and it is the one most modernization programs quietly retire. Do not retire it.

Sources