Skip to main content
OT Atlas
Search

2023 · Water / Wastewater

Unitronics PLC Targeting at Water Utilities

Internet-exposed programmable logic controllers at water utilities were accessed and defaced, with default credentials and direct internet reachability identified as the enabling conditions.

Direct OT impactUnited States and others

What happened

Attackers reached PLC/HMI units exposed directly to the internet, used default credentials and altered device displays; some facilities switched to manual operations.

Who

Public advisories associate the activity with an Iran-affiliated group.

Where

Multiple small water and wastewater utilities.

Why

Assessed objective: opportunistic disruption and messaging.

How

Direct internet exposure of controller interfaces combined with default credentials — no sophisticated exploitation required.

Timeline

  1. November 2023Incidents reported at multiple water and wastewater systems
  2. 1 December 2023Joint advisory published with mitigations

Attack path

Described at the level required to build detection and controls.

Initial Access

Reported

Direct internet access to controller interface

Control systems

Reported

Default credentials used to log in

Physical consequence

Reported

Device display altered; manual operations adopted

Impact

OT impactDevice interfaces altered; some utilities moved to manual operation as a precaution.
Safety impactNo publicly documented public-health impact.
Operational impactTemporary manual operations and incident response effort at small utilities.
Detected byOperators observing defaced device displays.

Technology involved

Unitronics Vision series integrated PLC/HMI units (V-series)PCOM on 20256/TCP exposed directly to the internetEmbedded VNC on 5900/TCPFactory-default device password (1111)Cellular routers with port-forwarding at unstaffed sites

ATT&CK techniques

T0822T0831

Vulnerabilities and weaknesses exploited

  • Default credentials and internet exposure rather than a novel product vulnerability
  • No network segmentation between the public internet and the controller
  • Integrated PLC+HMI design means one exposed device is both the operator screen and the process logic

Control failures

  • Controllers reachable from the internet
  • Default passwords unchanged
  • No monitoring of external access

Where earlier detection was possible

  • External attack-surface review for control devices
  • Alerting on inbound connections to controller ports
  • Credential audits on field devices

Defensive lessons

  • The most damaging conditions are often the simplest ones
  • Small utilities need external exposure reviews as a routine control
  • Manual operation capability remains a valuable resilience measure

Why should I care?

Case studies are only useful if they change something. Pick one lesson above and check whether the control exists in your own environment this week.

Sources & further reading