In late August 2026, foreign threat actors gained unauthorized access to the operational technology (OT) networks of two small, privately operated water utilities in Colorado. Publicly disclosed in mid-September 2026 by state officials. The intrusions involved direct interaction with industrial control equipment: attackers modified physical pumping cycles, altered device parameters, deactivated system alarms, and disabled remote access protocols.

While plant operators rapidly detected the anomalous activity, regained manual/local control, and prevented any degradation of water quality or disruption to public health, the incidents mark a significant escalation in water-sector targeting. Threat actors transitioned from passive network access or web defacements to direct manipulation of cyber-physical process parameters and safety visibility controls.

The most important fact about the Colorado incidents is not that two small water utilities were breached. It is that the reported activity involved unauthorized changes to operational equipment, pumping cycles, alarms and remote access while the utilities reportedly retained sufficient operational control to prevent an impact on treatment or water quality. The incident therefore sits at an important boundary: between cyber intrusion and cyber-physical consequence. The public evidence establishes the former, but not the latter.

Determining whether these incidents represent an Iranian campaign, opportunistic exploitation of exposed OT, or another form of targeting requires forensic evidence that has not yet been disclosed

This report provides a rigorous, evidence-grounded investigation into the Colorado incidents. By evaluating confirmed state disclosures, federal advisories, and technical threat intelligence from 2024 through 2026, this analysis establishes what actually occurred, scrutinizes the hypothesis of Iranian state-sponsored attribution, explores the strategic rationale for targeting small utilities, and delivers an operational defensive roadmap for critical infrastructure defenders.

Key findings and evidence taxonomy

To maintain strict analytical rigor, all findings in this report are categorized using the following evidence taxonomy:

• CONFIRMED: Directly supported by official statements from authoritative primary sources (e.g., Colorado Governor's Office, Colorado Department of Public Health and Environment [CDPHE], CISA).

• REPORTED: Documented by reputable cybersecurity or mainstream journalism but lacking public technical telemetry or official raw logs.

• CLAIMED: Asserted by non-governmental researchers, vendors, or political entities without public raw evidence.

• ASSESSED: Analytical conclusion derived by applying OT/ICS domain expertise to available evidence.

• UNKNOWN: Information that cannot be established from public sources.

 Summary of evidence findings

Incident timeline

The following timeline integrates the Colorado incidents within the broader 2026 water-sector threat environment across the United States.

Expanded Federal Warning Issued

July 2026

CISA and the FBI issue joint alerts warning of heightened targeting against vulnerable, internet-exposed Programmable Logic Controllers (PLCs) and cellular modems in the U.S. water and wastewater treatment sector.

Minnesota Water Sector Campaign

July 26–27, 2026

Over 30 community water systems in Minnesota experience coordinated cyber intrusions targeting PLCs and Human-Machine Interfaces (HMIs), causing temporary loss of water pressure and localized tank overflow in specific jurisdictions (e.g., South St. Paul, Plymouth). Federal authorities warned of a wave of cyber activity affecting water and wastewater systems across multiple U.S. states. The FBI reported that some incidents resulted in loss of visibility and, in some cases, functionality of connected equipment. CISA subsequently described approximately 100 water entities across roughly a dozen states as having been targeted.

CISA Discloses 100+ Exposed Systems Targeted

Early August 2026

Federal reporting in August 2026 described targeting involving approximately 100 water entities across roughly a dozen states. The relationship between those incidents and the later Colorado cases has not been publicly established.

Colorado Water Utility Intrusions Occur

Late August 2026

Foreign threat actors gain access to OT systems at two small private water utilities in Colorado. The attackers modify pump parameters, alter device settings, shut off remote administration access, and deactivate system alarms.

Detection and Local Recovery

Late August 2026

Facility operators detect operational anomalies, re-establish local manual control, reconfigure compromised settings, and notify the State of Colorado as mandated by drinking water regulations.

State verification and technical assistance

Late August – Early September 2026

The Colorado Department of Public Health and Environment (CDPHE) verifies that water quality and treatment processes remain safe, confirms the resolution of the incidents, and provides technical remediation assistance.

Public disclosure of Colorado intrusions

September 18–21, 2026

Colorado Governor Jared Polis's office confirms the cyberattacks to media outlets (KRDO, The Denver Post, SecurityWeek), citing involvement of "foreign actors" while noting broader national awareness of Iranian-backed water sector targeting.

Technical investigation and OT attack mechanics

Establishing what happened

The Colorado cyberattacks represent a direct cyber-physical interaction with water distribution equipment rather than a conventional IT data breach or ransomware event. Based on confirmed official disclosures and Shieldworkz analysis:

• Target profile: The victims were two distinct, privately owned water service providers operating in Colorado, each serving a population of fewer than 200 residents (~400 total).

• OT capabilities exercised: The threat actors executed write commands to operational equipment (disclosed activity studied by Shieldworkz demonstrates unauthorized changes to operational equipment settings, pumping cycles, alarms and remote-access functionality to impact operations). They modified physical equipment settings, changed the duty and timing cycles of water pumps, disabled alarm functions designed to notify operators of abnormal states, and terminated remote access pathways.

• Operational impact: The physical processes experienced brief deviations, but automatic or manual overrides allowed operators to quickly regain control. Water quality testing by CDPHE confirmed no chemical imbalance or contamination occurred.

Reconstruction of the OT Attack Path

While raw packet captures and forensic images from the two utilities have not been publicly released (No reliable public evidence was found to establish exact system logs), assessing the incident against historical water-sector threat patterns yields a probable attack pathway:

Step 1: Initial Access and Network Boundary Bypass

• Mechanism: Small water utilities frequently deploy cellular modems or direct serial-to-Ethernet converters to transmit telemetry from remote pump stations or tank sites back to a central HMI.

• Exposure: These cellular modems are frequently assigned public IPv4 addresses without a VPN tunnel or firewall. Attackers locate these endpoints using automated scanning engines listening on industrial protocols such as Modbus TCP (Port 502), EtherNet/IP (Port 44818), Siemens S7 (Port 102), or HTTP/HTTPS management interfaces.

• Authentication Failure: Access is typically achieved through default factory credentials, unauthenticated web administration portals, or unpatched remote code execution vulnerabilities in modem firmware.

Step 2: OT Device Parameter and Logic Interaction

• Protocol Execution: Once network access to the controller interface is achieved, the attacker does not require sophisticated custom malware (e.g., Stuxnet or PIPEDREAM). Industrial protocols lack native authentication by design. An attacker with sufficient access to an exposed controller or management interface may be able to manipulate operational parameters using legitimate or native control functionality. Whether that mechanism was used in Colorado is presently unknown.

• Parameter Modification: An attacker issuing standard function codes (e.g., Modbus Function Code 06 "Write Single Register" or FC 16 "Write Multiple Registers") can directly rewrite controller memory blocks:

  • Pumping Cycles: Modifying start/stop threshold registers (e.g., changing tank level setpoints from 80% to 10% or changing duty timer coils) forces pumps to short-cycle, run dry, or fail to engage when water levels drop.

  • Device Settings: Changing control loop parameters (PID gain constants or timers) destabilizes automated process control.

Step 3: Alarm Suppression & Remote Access Severance

• Alarm Suppression: Attackers navigated to alarm management registers or HMI display configurations and suppressed visual/audible threshold alerts. In OT environments, alarms dictate operator awareness. Suppressing an alarm converts an urgent process deviation into an invisible anomaly.

• Remote Access Severance: Attackers modified administration passwords, altered gateway IP configurations, or disabled SSH/Telnet/HTTP management interfaces on the remote gateway. This step denied remote operators and outsourced engineering vendors access to the system, forcing defenders to physically drive to remote pump houses to re-establish manual control.

Potential consequences of the observed attack actions

To understand the real-world operational threat, the cyber actions observed in Colorado are mapped to their technical, physical, and potential safety consequences below:

Strategic analysis: The Colorado incidents

The Colorado attacks reveal tactical insights that distinguish them from typical opportunistic cybercrime.

Why target micro-utilities?

Why would a foreign threat actor target two remote, private utilities serving under 200 people each?

• Path of Least Resistance for Cyber-Physical Capability Testing: Large municipal utilities employ multi-layered IT/OT segmentation, continuous network monitoring, and dedicated engineering teams. Micro-utilities rely on flat networks, third-party contractors, and direct internet access via cellular modems. For threat actors seeking to test cyber-physical capabilities on live infrastructure, small utilities serve as low-cost, low-risk proving grounds.

• Automated Sector-Wide Scanning: Adversaries rarely target micro-utilities by name. Instead, they scan wide IPv4 ranges assigned to major cellular carriers for open industrial ports. The discovery of these two utilities was almost certainly the result of automated, broad-spectrum reconnaissance rather than bespoke intelligence gathering. Automated discovery of exposed industrial systems is a plausible explanation, particularly given the broader targeting of internet-accessible OT devices documented by U.S. authorities. However, the public evidence does not establish how these two Colorado utilities were discovered.”

• Psychological and Regulatory Impact: Striking critical infrastructure in small communities creates an outsized psychological effect. It demonstrates that no community is too small or isolated to escape foreign cyber interference, pressuring state and federal regulators to divert resources to rural protection.

Dual-Pronged Sabotage: Process Manipulation vs. Defender Blindness

The combination of changing pump cycles and disabling alarms and remote access represents a sophisticated tactical tradecraft:

• Attacking Availability vs. Integrity vs. Visibility:

  • Changing pump cycles attacks Process Integrity.

  • Disabling remote access attacks System Availability.

  • Suppressing alarms attacks Operator Visibility.

• The Defender Blindspot: By disabling remote access and alarms simultaneously, the attacker defangs the defender. When the pump cycle alteration begins causing physical stress (e.g., tank depletion or pipe vibration), the SCADA console displays "normal" status because alarms are muted. When the operator notices physical anomalies and attempts to log in remotely to inspect the PLC, the remote connection fails.

• Conclusion: The primary danger in this attack pattern was not the magnitude of the pump cycle change itself, but the deliberate suppression of the feedback loops that allow human operators to detect and remediate process anomalies.

Attribution investigation: The Iran hypothesis

A central analytical question is whether the Colorado intrusions can be attributed to Iranian state-sponsored or Iran-affiliated threat actors (such as CyberAveng3rs or Islamic Revolutionary Guard Corps [IRGC]-affiliated groups).

Comparative Context: Documented Iran-Linked Activity (2024–2026)

“Iran is a relevant attribution hypothesis because U.S. authorities have previously documented IRGC-affiliated cyber actors targeting internet-accessible PLCs used in water and wastewater facilities. CISA and its partner agencies documented CyberAv3ngers activity involving Unitronics PLCs, including unauthorized access to internet-facing devices, manipulation of ladder logic, and actions intended to disrupt device functionality or prevent legitimate operator access.

• Targeting Equipment: Historically focused on Israeli-made Unitronics Vision PLCs, expanding in 2025–2026 to Rockwell Automation (Allen-Bradley), Schneider Electric, and Siemens S7 controllers exposed on the public internet.

• Tactics, Techniques, and Procedures (TTPs):

• Mass scanning for industrial ports (TCP 502, 44818, 22826).

• Exploitation of default passwords (e.g., 1111 or vendor defaults).

• Overwriting PLC display screens with anti-Israel/anti-US political messages.

• Modifying PLC configurations, altering administrator passwords, and resetting device IP addresses to lock out legitimate operators.

• Disrupting telemetry to force manual operation.

Evaluating evidence  

 Evidence supporting the Iran hypothesis

1. TTP Alignment: The specific technique of modifying PLC parameters while simultaneously altering credentials/IPs to lock out operators directly mirrors TTPs documented in CISA Advisory AA23-335A and 2026 CISA alerts regarding Iranian IRGC-affiliated cyber operations.

2. Victim Alignment: Iranian groups have consistently targeted small-to-medium municipal and private water entities where direct internet exposure of PLCs via cellular modems is prevalent.

3. Temporal Context: The attacks occurred during an active campaign by Iranian actors targeting U.S. water infrastructure across 12 states, as warned by CISA in July and August 2026.

Evidence weakening the Iran hypothesis

• Absence of Hacktivist Branding: Documented Iranian campaigns (e.g., CyberAveng3rs) routinely post video evidence, defacement screens, or social media announcements claiming responsibility for propaganda value. No such claims have been linked to the Colorado incidents.

• Ubiquity of Exploitable Vectors: Internet-facing PLCs with default credentials can be exploited by ransomware affiliates, generic cybercriminals, or rival nation-states using basic script-kiddie tools. Similar technique does not equal identical attribution.

• Explicit State Refusal to Attribute: The Colorado Governor’s office explicitly stated: "We cannot confirm what foreign actors may have been involved..." State and federal investigators have withheld formal attribution.

Analytical attribution assessment

ASSESSED VERDICT: High-confidence assessment that the tactics used in Colorado align with known Iranian state-sponsored playbooks; LOW-TO-MEDIUM CONFIDENCE on definitive attribution to a specific Iranian group due to the absence of technical artifacts (such as unique malware signatures, infrastructure overlap, or public claims) (These characteristics are not unique to Iranian actors, and the available public evidence does not support attribution of the Colorado incidents to a specific Iranian actor or group). The activity remains formally UNCONFIRMED and classified under generic foreign-actor threat activity.  

The small-utility structural vulnerability model

The Colorado incidents underscore systemic vulnerabilities inherent to small drinking water and wastewater operations.

Why small utilities face outsized risk

• Resource Asymmetry: Small utilities serving fewer than 1,000 residents operate on tight budgets. They lack dedicated IT/OT security personnel, relying on generalist water operators who manage both physical chemistry and technical infrastructure.

• Ubiquity of Cellular Modems: Remote pump stations, wellheads, and elevated storage tanks are often miles away from central treatment facilities. Installing leased fiber or private radio links is cost-prohibitive. Cellular modems with static public IP addresses are deployed as a low-cost alternative, creating direct pathways from the public internet to physical machinery.

• Outsourced Integrator Reliance: Engineering integrators frequently deploy identical base configurations across dozens of small utility clients. A single weak remote access setup or shared credential used by an integrator exposes every utility in their customer portfolio.

• Flat OT Networks: Once an attacker crosses the cellular gateway, there are no internal firewalls or jump hosts. The gateway sits on the same unsegmented Layer 2 network as the PLC, HMI, and local logging equipment.

Physical risk and process impact analysis

Critical infrastructure threat analysis must distinguish between Cyber Compromise, Control Manipulation, and Public Health Impact to uphold objectivity.

The water Cyber-Physical Risk chain

• Cyber Access: Attacker accesses PLC/HMI interface via compromised cellular gateway.

• Control Execution: Attacker overwrites logic coils, alters duty timers, or forces output bits.

• Process Drift: Physical pumps alter speed, valves open/close out of sequence, or chemical dosing pumps change rates.

• Safety Interlock Activation: Independent hardwired safety devices (e.g., physical high-pressure relief valves, thermal overload relays, mechanical level float switches) trigger independently of PLC software logic.

• Human Operator Intervention: Operators detect discrepancies via physical gauges, sight glasses, or unusual motor noise, switching control panels from AUTO to HAND (manual).

• Public Safety Impact: Only if safety interlocks fail and operators are entirely absent can process drift cause physical damage, pipe collapse, chemical contamination, or water supply loss.

Based on the public account and Shieldworkz assessment, the incidents were detected and remediated before officials identified an impact to treatment, water quality or public safety. The precise sequence of operator detection, local intervention and system restoration has not been publicly detailed

Comprehensive water OT attack surface analysis

The table below details the complete attack surface typical of U.S. water utilities, outlining operational relevance, common exposure points, potential attacker impact, and key defensive controls.

Defensive architecture and operational hardening

Defending water OT environments requires practical, defense-in-depth measures tailored to resource-constrained operators.

1. Immediate High-Impact Remediation Controls

• Eliminate Direct Internet Exposure: Immediately disconnect all PLCs, RTUs, and HMIs from direct public IPv4 addressing. Ensure cellular modems route traffic through private Access Point Names (APNs) and encrypted IPsec VPN tunnels terminating at a central firewall.

• Harden PLC Credentials: Change factory default passwords on all PLC web interfaces, FTP services, and programming portals. Where hardware supports it, enable administrative password protection for ladder logic download/upload functions.

• Firmware and Interface Disablement: Disable unused protocols and management services on PLCs and gateways (e.g., HTTP, HTTPS, Telnet, FTP, SNMP) if they are not strictly required for control operations.

• Golden Image Management: Extract, verify, and store offline copies ("golden images") of all PLC project files (.ACD, .L5X, .SBS, etc.) and logic configurations to enable rapid manual re-flashing during an incident.

2. Network Architecture & Segmentation (ISA/IEC 62443 Alignment)

• Purdue Model Enforcement: Enforce strict firewall separation between Level 2 (HMI/SCADA), Level 1 (PLCs/Controllers), and Level 0 (Sensors/Actuators).

• OT DMZ Implementation: Deploy an OT DMZ between Corporate IT and OT Control zones. All remote access must pass through a multi-factor authenticated (MFA) Jump Host located in the OT DMZ. Direct IT-to-OT routing must be explicitly blocked.

• Vendor Access Control: Third-party integrator connections must remain disabled by default (Normally Closed). Remote access tunnels should only be activated on-demand for approved maintenance windows and automatically revoked upon completion.

OT detection engineering and SOC use cases

Security Operations Centers (SOCs) monitoring water OT environments must deploy specialized detection rules targeting control system protocol anomalies and configuration shifts.

Detection Engineering Table

Use Case 1: Unauthorized PLC Password or Credentials Modification

• Signal: Syslog event or audit log indicating a administrative password change or credential update on a PLC, gateway, or HMI.

• Why It Matters: Indicates an attacker attempting to lock out operators and secure persistence.

• Data Source: Controller audit logs, firewall logs, gateway web interface access logs.

• Investigation Steps: Cross-reference event timestamp against approved engineering change tickets. Identify source IP address. If source IP is external or unapproved, isolate the device immediately.

• Possible False Positives: Scheduled password rotation by authorized engineering personnel.

Use Case 2: PLC Configuration / Logic Download Outside Maintenance Window

• Signal: Protocol command indicating ladder logic download/upload. Detect controller programming, configuration or logic-transfer activity outside approved engineering windows. Detection should be based on vendor-specific protocol telemetry, controller audit logs and engineering-workstation activity rather than a single universal protocol signature.

• Why It Matters: Attacker is modifying operational ladder logic, setpoints, or safety thresholds.

• Data Source: OT Network Intrusion Detection System (NIDS) inspection (such as Shieldworkz)

• Investigation Steps: Verify if the workstation IP issuing the command belongs to an authorized Engineering Workstation (EWS). Confirm if an active maintenance window is open.

• Possible False Positives: Emergency repairs conducted by on-call engineers.

  
  

Use Case 3: Disabling or Muting SCADA Alarm Thresholds

• Signal: HMI tag write event changing alarm status registers from 1 (Enabled) to 0 (Disabled), or shifting high-pressure alarm limits beyond physical sensor bounds.

• Why It Matters: Attacker suppressing visual/audible alarms to hide process disruption.

• Data Source: SCADA Server audit trails, HMI event database logs.

• Investigation Steps: Identify the operator account logged into the HMI. Verify if physical maintenance (e.g., sensor calibration) is taking place that requires temporary alarm muting.

• Possible False Positives: Operator suppressing nuisance alarms during legitimate equipment maintenance.

Use Case 4: Unexpected Inbound Session to Field Gateway from External IPv4

• Signal: Inbound TCP connection attempt to a cellular modem or PLC on industrial ports (502, 44818, 102, 22826) originating from a public internet IP address.

• Why It Matters: Indicates active external port scanning or unauthorized initial access attempt.

• Data Source: Cellular modem firewall logs, edge router NetFlow/IPFIX data.

• Investigation Steps: Check target IP against asset inventory. Block source IP at upstream carrier/firewall level. Determine if connection succeeded or was dropped.

• Possible False Positives: Automated health checks from authorized cloud-based telemetry providers.

Use Case 5: Direct PLC Communication via Cellular Gateway Bypassing OT Firewall

• Signal: Internal PLC initiating or receiving network traffic directly to/from a cellular gateway IP without traversing the internal OT security gateway.

• Why It Matters: Indicates an unauthorized or rogue remote access pathway (shadow IT/OT) bypassing perimeter defenses.

• Data Source: Core switch SPAN port telemetry, OT NIDS asset discovery alerts.

• Investigation Steps: Trace physical network port of the cellular gateway. Inspect firewall configurations to determine why traffic bypassed segmentation controls.

• Possible False Positives: Legacy backup communications channel re-activated during primary link failure.

Water OT cybersecurity KPI and KRI framework

To evaluate OT security posture, water utilities must move away from generic IT metrics (e.g., number of patches installed) toward OT-centric Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs).

Interactive water OT metrics and risk dashboard explorer

The interactive concept tool below demonstrates how water utility leadership and OT security managers can track posture, exposure, and resilience metrics in real time.

Core metric definitions

Water OT incident response playbook

When anomalous OT behavior or unauthorized configuration changes are detected, operators and responders must follow a disciplined response protocol.

Phase 1: First 30 Minutes (safety and containment)

1. Prioritize Physical Safety: Verify physical process parameters (water level, system pressure, disinfectant residual) using local physical gauges, sight glasses, and mechanical indicators.

2. Engage Manual Control Override: Switch critical equipment panels from AUTO to HAND (manual) mode. Disengage automated PLC outputs if process parameters drift wildly.

3. Isolate Remote Access Tunnels: Disconnect external network links, cellular gateways, and WAN firewalls. Crucial: Do not power cycle or reboot PLCs/HMIs, as power cycling erases volatile memory (RAM) containing critical forensic evidence.

Phase 2: First 2 Hours (Triage & Evidence Preservation)

1. Preserve Digital Evidence: Collect network traffic captures (PCAPs) from managed switches. Secure firewall logs, cellular modem event logs, and SCADA database audit trails.

2. Assess Logic and Parameter State: Compare running PLC configurations against offline "golden image" project files to identify altered setpoints, modified coils, or updated passwords.

3. Regulatory Notification: Notify relevant regulatory bodies (e.g., CDPHE in Colorado, EPA Water Desk, CISA Central, local fusion centers) as required by state drinking water regulations.

Phase 3: First 24 Hours (Remediation & Restoration)

1. Restore logic and configuration: Restore controller logic and configuration from a validated known-good baseline when investigation and operational engineering determine that restoration is required. Validate the process state before returning equipment to automated operation.

2. Re-Establish Hardened Remote Access: Reconfigure remote gateways to require private APNs and hardware-backed MFA before re-connecting to central networks.

3. Conduct Comprehensive Water Quality Testing: Execute full laboratory chemical and microbiological sampling to independently verify water safety before returning systems to automated operation.

4. 
   

Operational Warning: Risk of Abrupt System Disconnection

CRITICAL CAUTION: Indiscriminately pulling network cables or shutting off power to OT networks during an active incident can induce sudden process trips, cause severe water hammer, burst distribution pipes, or shut down chemical dosing. Network isolation must be performed systematically, ensuring operators are physically stationed at equipment panels to maintain continuous manual process control.

Security findings in water OT

The Colorado incidents reveal several subtle technical vulnerabilities that receive insufficient attention in mainstream cybersecurity guidance:

1. Cellular Modems as Shadow Entry Points: Utility asset inventories frequently track PLCs and SCADA servers while completely omitting unmanaged cellular gateways deployed by field contractors.

2. Alarm Manipulation as an Evasion Strategy: Attackers recognize that disabling alarms buys them extended dwell time, turning quiet process drift into unmonitored operational degradation.

3. Asymmetry of Protocol Security: Standard industrial protocols (Modbus, EtherNet/IP) lack authentication. An attacker who reaches TCP Port 502 has full administrative control over the physical process without needing an exploit.

4. Fragility of Remote Incident Response: Disabling remote access protocols prevents remote defenders from diagnosing or mitigating attacks, turning a cyber incident into a logistically demanding field deployment.

5. Inability to Prove Past State Integrity: Most small utilities lack sufficient historical telemetry and configuration baselines to establish whether unauthorized changes occurred before detection.

6. Integrator Credential Sprawl: Engineering contractors frequently reuse identical maintenance passwords across dozens of municipal clients, creating single points of failure across entire regions.

7. Erosion of Manual Operating Skills: As utilities increase automation, younger operators may lack hands-on experience running treatment plants in pure manual (HAND) mode during extended cyber outages.

8. Lack of Forensic Preservation Capabilities: Standard IT incident response playbooks fail in OT environments when responders accidentally power-cycle PLCs, wiping volatile memory and forensic evidence.

9. Firmware Integrity Deficits: Legacy PLCs lack secure boot mechanisms, allowing attackers to upload altered firmware or modify memory blocks without generating cryptographic hash errors.

10. The False Sense of Security in Micro-Scale Targets: Operational teams often assume that small population sizes render them uninteresting to foreign adversaries, failing to realize that automated scanning targets exposed IP addresses rather than population counts.

Strategic analytical hypotheses

Beyond basic incident reporting, senior threat analysts must evaluate broader strategic questions regarding attacker intent:

1. Was this process sabotage or operator defanging? The evidence suggests the primary tactical effort was directed at disabling operator visibility and control (suppressing alarms and blocking remote access) rather than immediate catastrophic destruction. The process modification (pump cycling) served to test whether physical effects could be induced quietly while feedback loops were muted.

2. Capability Proving Ground: Small utilities offer low-consequence environments for adversaries to train operators, test automated OT scanning tools, and validate protocol write commands against operational hardware without risking immediate military or diplomatic retaliation.

3. The Low-Cost Cyber-Physical Weapon: Water infrastructure represents an exceptionally low-cost environment for demonstrating cyber-physical capability. Exploiting an exposed Modbus controller requires zero zero-day exploits, minimal financial investment, and basic technical skills, yet yields national media coverage and government engagement.

   
   

Cross-sector critical infrastructure comparison

Comparing the water sector with other critical infrastructure sectors highlights unique operational constraints and risk profiles.

Regulatory and standards alignment matrix

The table below maps the specific operational weaknesses observed in the Colorado incidents to established industrial cybersecurity standards and frameworks.

30-60-90 day defensive remediation roadmap

This actionable roadmap provides a structured schedule for water utilities seeking to systematically eliminate the vulnerabilities exposed by the Colorado incidents.

Phase 1: Days 0–30 — Exposure Reduction & Perimeter Hardening

• Objective: Eliminate direct internet accessibility and secure remote administrative access.

• Technical Actions:
  
  
  

  1. Perform external IPv4 exposure scans across all utility-owned and cellular carrier IP ranges using tools like Shodan and Censys.

  2. Disconnect any PLC, RTU, or HMI connected directly to public IPv4 space. Re-route connections through private cellular APNs or encrypted IPsec VPNs.

  3. Enforce mandatory multi-factor authentication (MFA) across all remote access gateways and vendor maintenance portals.

  4. Change default administrative credentials on every cellular router, firewall, and industrial controller.

• Responsible Team: OT Network Engineering / IT Operations.

• KPI: 0 internet-exposed PLCs; 100% remote access channels protected by MFA.

Phase 2: Days 31–60 — Network Segmentation & Configuration Integrity

• Objective: Establish formal network zone boundaries and secure controller baseline configurations.

• Technical Actions:
  
  

  1. Implement firewall segmentation separating corporate IT, SCADA/HMI management, and PLC field networks (ISA/IEC 62443 Zone/Conduit model).

  2. Extract logic files from all active PLCs, verify their integrity against baseline specifications, and archive clean "golden images" in secure offline storage.

  3. Restrict third-party vendor connections to on-demand, time-bound access windows requiring explicit operator approval.

     
     

• Responsible Team: Systems Integrator / Plant Engineering.

• KPI: 100% of PLCs backed up with verified golden images; 0 persistent unsegmented vendor connections.

Phase 3: Days 61–90 — Detection Engineering & Resilience Validation

• Objective: Deploy process-aware monitoring and validate manual operating capability.

• Technical Actions:
  
  

  1. Enable logging on firewalls and managed switches to capture industrial protocol write commands (Modbus, CIP, S7).

  2. Implement SOC alert rules for anomalous PLC configuration changes, password updates, and alarm muting.

  3. Conduct a physical tabletop exercise and operational drill testing the facility's ability to operate in manual (HAND) mode for 48 consecutive hours without automated SCADA systems.

• Responsible Team: SOC Team / Plant Operators / CISO.

• KPI: MTTMT (Mean Time to Manual Takeover) verified under 15 minutes; incident response playbook exercised.

Executive and stakeholder implications

Cyberattacks targeting critical operational technology require coordinated leadership across technical, operational, and executive roles.

Guidance for Executives and Board Members

• General Manager / Executive Director: Understand that OT cybersecurity is a core public safety responsibility, not merely an IT expense. Ensure small-utility budgets prioritize secure remote access and private cellular networking.

• Chief Information Security Officer (CISO): Bridging the IT/OT divide is essential. Ensure IT security monitoring extends into Level 1 and Level 2 OT networks without introducing disruptive automated blocking mechanisms that could destabilize physical processes.

• Plant Operations Manager: Maintain manual operating capability. Automation is a efficiency tool, but manual overrides are an essential safety safety net. Train operators regularly on manual chemical dosing and valve management.

• SOC Lead / Incident Response Lead: Develop OT-specific threat hunting and incident playbooks. Ensure analysts understand that an anomalous packet in OT can represent physical movement or process disruption, requiring immediate operational verification before executing network containment.

Final analytical assessment

Comprehensive assessment synthesis

• What Definitely Happened: In late August 2026, foreign cyber threat actors breached the OT systems of two small, privately operated water utilities in Colorado. The attackers directly interacted with control equipment—modifying pump cycles, altering settings, muting system alarms, and terminating remote administrative access. Operators rapidly detected the anomalies, asserted local manual control, and restored configurations without any public health impact or water quality degradation.

• What Probably Happened: The intrusions were likely enabled by internet-exposed cellular modems or direct controller interfaces left unauthenticated on public IPv4 addresses, identified via broad automated port scanning. The attackers executed standard, unauthenticated industrial protocol write commands to alter control parameters while systematically defanging defender visibility and remote access.

• What Remains Unknown: No reliable public evidence was found to establish the specific nation-state identity of the attackers, the exact PLC/HMI vendor hardware models involved, or the precise forensic log artifacts from the victims' networks.

• Attribution Assessment: While the attack techniques closely resemble documented playbooks executed by Iranian-backed groups (such as CyberAveng3rs) targeting U.S. water infrastructure throughout 2024–2026, direct technical attribution for the Colorado breaches remains UNCONFIRMED. Defenders must focus on remediating the underlying structural vulnerability—internet-exposed controllers—rather than relying solely on threat actor signatures.

• The Strategic Takeaway: The Colorado incidents confirm that critical infrastructure threat actors have shifted from passive reconnaissance and administrative IT breaches to direct cyber-physical parameter manipulation and defender defanging. By targeting small water utilities, adversaries exploit systemic resource limitations to conduct low-cost operational testing. Critical infrastructure defenders must immediately remove PLCs from public internet access, enforce multi-factor authentication on all remote access channels, and preserve robust manual operating capabilities.

Additional references

1. SecurityWeek: Colorado Water Utilities Hit by Cyberattacks Targeting OT Systems (Published Sept 21, 2026). Primary reporting on state disclosures regarding pump cycle alterations, remote access severance, and alarm suppression.

2. Office of Governor Jared Polis / Colorado Department of Public Health and Environment (CDPHE): Official state statements issued to KRDO News and The Denver Post confirming foreign actor involvement in two private utilities serving under 200 residents each, with no water quality impact.

3. CISA / FBI / EPA Joint Cybersecurity Advisories (2024–2026): Defending Operational Technology Against Iranian-Backed Threat Activity and Top Cyber Exposures in Water and Wastewater Systems, detailing internet-exposed PLCs, cellular modems, and default credential risks.

4. FacilitiesDive: What We Know About the Hacking Campaign Against US Water Systems (Published Aug 25, 2026). Coverage of nationwide July–August 2026 water attacks affecting 100+ exposed systems across 12 states (including Minnesota, Michigan, and Georgia).

5. Infracritical / Threat Intelligence Repository: Operational tracking data and aggregate technical indicators regarding water-sector PLC exposure via cellular gateways (2026).

6. ISA/IEC 62443 Standard Series: Security for Industrial Automation and Control Systems — Zone and Conduit design principles and System Security Requirements (SRs).

7. NIST SP 800-82 Rev. 3: Guide to Operational Technology (OT) Security, National Institute of Standards and Technology.