CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs

CISA reports active threat activity against internet-exposed programmable logic controllers (PLCs) in the water and wastewater sector, including password changes and IP-address modification that locked out operators, disconnected PLCs, caused boil-water notices, and forced sustained manual operations. CISA urges immediate removal of PLCs and other OT from direct internet exposure, use of VPNs or gateways, strong unique passwords, IP allowlisting, and clean PLC-image backups. The feed also records multiple additions to CISA’s Known Exploited Vulnerabilities Catalog based on active exploitation,