Cyber resilience assessment against Iran-linked threat pathways for water and wastewater systems

Startseite

Blogs

Cyber resilience assessment against Iran-linked threat pathways for water and wastewater systems

Preperation to counter Iranian cyber threats

Team Shieldworkz

5. August 2026

Essential context and threat baseline

This assessment framework offers water and wastewater treatment facilities, SCADA engineers, and IT/OT cybersecurity teams with an evidence-based method to evaluate, grade, and remediate risk associated with Iran-linked threat pathways. This can be considered as a starting point for understanding your risk exposure but this exercise cannot be considered as a substitute for a comprehensive IEC 62443-based cyber risk assessment.

Threat actors associated with Iran including advanced persistent threat (APT) groups designated as CyberAv3ngers, MuddyWater (TEMP.Zagros), Cotton Sandstorm (MARINHO), and Charming Kitten (APT35) have demonstrated distinct operational patterns across the critical infrastructure sector. Historically, these actors leverage opportunistic exploitation of internet-facing operational technology (OT) assets, default or weak credentials, unpatched edge vulnerabilities, software supply-chain compromises, and spear-phishing campaigns against corporate IT networks to gain initial access.

Attribution and technique mapping matrix

Category	Observed TTP / Threat Pathway	Documented Iranian Threat Linkage	Critical Infrastructure / Water Sector Impact	Primary Source / Advisory
Opportunistic OT Exploitation	Unauthenticated remote access via HTTP/HTTPS/SSH; default vendor credentials on PLCs/HMIs (e.g., Unitronics Vision series).	CyberAv3ngers(IRGC-affiliated) target of Unitronics Programmable Logic Controllers.	Unauthorized parameter changes, localized defacement of HMI screens, loss of view/control.	CISA Joint AA23-335A; FBI-CISA-NSA Advisory (Nov 2023)
Edge & Remote Access Exploitation	Exploitation of known CVEs in internet-facing gateways, firewalls, and VPNs (e.g., Fortinet FortiOS, Citrix Bleed, Pulse Secure, Exchange).	Pioneer Kitten(Rubrik Phantom/UNC757), MuddyWater.	Initial access to IT/DMZ, credential dumping, internal reconnaissance, broker access to ransomware affiliates.	CISA Joint AA24-241A; NSA/FBI Advisory (Aug 2024)
Living-off-the-Land (LotL) & Admin Tools	Misuse of native administrative tools (PowerShell, WMI, RDP, PsExec, NetScan, AnyDesk, ScreenConnect).	Charming Kitten, MuddyWater, Pioneer Kitten.	Internal lateral movement without custom malware execution; evasion of host-based security software.	MITRE ATT&CK Group G0069, G0014; CISA AA22-075A
IT-to-OT Lateral Movement	Exploitation of dual-homed engineering workstations, flat network designs, and shared Active Directory domains.	Generic Cyber Espionage / Sabotage observed across Iranian APT actors.	Transition from corporate network compromise to direct SCADA/HMI network access.	NIST SP 800-82 Rev 3; CISA CPGs
OT Protocol Abuse (Generic Weakness)	Unauthenticated read/write commands over legacy protocols (Modbus TCP, DNP3, Ethernet/IP, EtherCAT).	General OT Vulnerability (Not exclusive to Iran, but exploited when reached).	Manipulation of process control variables, unexpected coil writes, false telemetry injection.	IEC 62443-3-3; CISA ICS Advisory Standards

Documented Iran-linked threat context:

Opportunistic OT Targeting: In late 2023, CISA, the FBI, the NSA, the EPA, and the INCD (Israel) released joint advisory AA23-335A. It confirmed that Iranian Islamic Revolutionary Guard Corps (IRGC)-affiliated cyber actors (often operating under the persona "CyberAv3ngers") actively targeted and compromised Unitronics Vision Series PLCs in the Water and Wastewater Systems (WWS) sector.
Documented TTPs in WWS: The actors targeted PLCs directly exposed to the internet via TCP port 20256, exploiting default credentials (1111). Upon access, they defaced the HMI screen and effectively rendered the PLC unresponsive to legitimate commands.
IT-to-OT Pivot Potential: Other Iranian state-sponsored actors (such as those tracked as MuddyWater, APT33, or Pioneer Kitten) historically focus on IT environments, exploiting unpatched VPNs, firewalls, and remote access gateways for initial access, followed by credential dumping and "living off the land" (using native tools like PowerShell and WMI). While historically IT-focused, inadequate IT/OT segmentation provides a plausible pathway for these actors to impact OT operations.

This assessment evaluates defenses against both the opportunistic exploitation of internet-facing OT assets (direct impact) and the targeted exploitation of IT perimeters leading to lateral movement (indirect impact), aligned with IEC 62443 principles and NIST SP 800-82.

Mapping to IEC 62443

Assessment framework and questionnaire

Instructions

Evaluate each control. Provide a response, note the evidence required to validate the claim, and record the grade using the methodology in Section 4.

#	Assessment Domain	Question	Response	Evidence Required	Grade (0-3)	Risk/Observation
A1	Governance	Has the utility clearly defined and documented ownership of OT cybersecurity decisions during a plant emergency (e.g., who has the authority to sever the IT/OT connection)?	[ ] Yes [ ] Partial [ ] No [ ] Unk [ ] N/A	Incident Response Plan (IRP) detailing authority matrix; exercise logs testing this authority.
A2	Governance	Are threat intelligence advisories (e.g., WaterISAC, CISA ICS-CERT) actively monitored, and is there a process to operationalize them (e.g., checking for AA23-335A IOCs)?		Threat intel SOPs; ticketing system records showing advisory reviews.
B1	Asset Visibility	Does the facility maintain a current, comprehensive OT asset inventory (PLCs, HMIs, EWS, telemetries) and a validated physical/logical network architecture diagram?		Current architecture diagram (Purdue model mapped); OT asset inventory list (hardware/firmware versions).
B2	Asset Visibility	Are there any legacy, unsupported, or vendor-maintained assets in the OT environment that are "black boxes" to the internal security team?		Vendor contracts; network scanning logs verifying no "shadow OT" devices exist.
C1	IT/OT Segmentation	Is the OT environment strictly segmented from the corporate IT network using an architecture consistent with IEC 62443 Zones and Conduits (e.g., OT DMZ, no direct internet routing)?		Firewall rule base review (confirming deny-by-default, no any-any rules); routing tables.
C2	IT/OT Segmentation	Do any OT assets (specifically PLCs, RTUs, or HMIs) possess a direct pathway to the internet, whether intentional or accidental? (Critical focus per CISA AA23-335A)		External vulnerability scan reports (Shodan/Censys checks); perimeter firewall configuration.
D1	Remote Access	Is all remote access to the OT environment routed through a secured, monitored gateway (e.g., Jump Server in the DMZ) utilizing multi-factor authentication (MFA)?		VPN configuration files enforcing MFA; Active Directory/Identity Provider logs.
D2	Remote Access	Are vendor remote maintenance connections default-deny, requiring internal approval to enable for a specific, time-bound window?		Remote access policy; vendor connection logs showing explicit enable/disable actions.
E1	Identity & Access	Are all default passwords on OT devices (specifically PLCs, HMIs, network switches) changed prior to production deployment? (Direct mitigation for IRGC TTPs)		Configuration standards document; device configuration files demonstrating non-default credential usage.
E2	Identity & Access	Does the facility enforce unique user accounts and least privilege, prohibiting the use of shared or group accounts on Engineering Workstations and SCADA servers?		Active Directory/Local user lists on OT servers; privileged access management (PAM) logs.
F1	Vuln & Config	Is there an OT-safe vulnerability and patch management process that categorizes patches by operational risk and tests them prior to deployment?		Patch management policy specifying OT vs. IT SLAs; test lab documentation; change control records.
F2	Vuln & Config	Are regular, secure configuration backups of critical OT devices (PLC logic, RTU configs, switch configs) maintained and verified?		Backup logs; MD5/SHA256 hashes of known-good logic; offline storage verification.
G1	OT Protocols	Can the facility identify which industrial protocols (e.g., Modbus TCP, DNP3, Ethernet/IP) are actually in use, and restrict communications strictly to required paths?		Baseline network traffic captures (PCAP); firewall rules restricted by port/protocol (e.g., Modbus TCP 502).
H1	Workstation Sec.	Are Engineering Workstations (EWS) hardened (e.g., application control/whitelisting, USB mass storage disabled, local admin restricted)?		Group Policy Object (GPO) settings; application control enforcement logs.
I1	Detection	Does the facility have the capability to detect suspicious authentication events (e.g., impossible travel, unexpected vendor VPN logins at 3 AM)?		SIEM/Log management dashboards; SOC alerting rules configured for VPN telemetry.
I2	Detection	Is there visibility into east-west OT network traffic to detect unauthorized PLC program downloads, logic changes, or abnormal command patterns?		OT network monitoring tool alerts (e.g., Dragos, Claroty, Nozomi) or configured SPAN port PCAPs.
J1	Incident Response	Does the facility have an OT-specific Incident Response Plan (IRP) that details procedures for safely shutting down processes or severing IT/OT links during a cyber event?		OT IRP document; documentation of out-of-band communication plans.
K1	Backup/Recovery	Have OT restoration procedures from offline, immutable backups been physically tested and validated within the last 12 months?		Post-exercise report (AAR) of a tabletop or physical recovery drill validating RTO/RPO.
L1	Operational Res.	If SCADA or HMIs are compromised and rendered inoperable, can operators safely transition to and sustain manual, local control of critical water processes?		Standard Operating Procedures (SOPs) for manual operations; logs of physical operator training.
M1	Physical Conse.	Are there independent, non-digital mechanical safeguards (e.g., physical pressure relief valves, mechanical overflow preventers) to prevent cyber-physical catastrophic failures?		Engineering diagrams (P&ID) showing mechanical safety systems independent of PLC control.

Grading methodology

Calculate the score based on the validated evidence. Self-attestation without evidence equals 1 point (Unknown/Cannot Demonstrate). Do not allow "N/A" for core infrastructure questions (e.g., Backups, Asset Visibility) unless the organization physically lacks the asset type.

3 Points: Yes / Fully Implemented (Evidence provided, regularly tested).
2 Points: Partially Implemented (Policy exists but enforcement is inconsistent; partial evidence).
1 Point: Unknown / Cannot Demonstrate (Claimed as "Yes" but no evidence exists; reliance on assumptions).
0 Points: No / Not Implemented (Control does not exist).
Excluded: Not Applicable (Requires rigorous justification).

Cumulative score and overall grade

Total Score: ____ / 60 (Assuming 20 questions x 3 points. Adjust denominator if N/A is validly used).

Percentage: ____ %

Score Range	Grade	Interpretation
90–100%	A	Strong resilience: Facility demonstrates advanced IEC 62443 compliance, robust segmentation, and threat-informed detection.
75–89%	B	Good resilience: Core hygiene is solid, but identifiable gaps exist in monitoring, vendor access, or recovery testing.
60–74%	C	Moderate exposure: Material weaknesses in segmentation, access control, or asset visibility that a determined actor could exploit.
40–59%	D	High exposure: Significant architectural or governance flaws. High likelihood of IT-to-OT pivot or operational disruption.
0–39%	F	Critical exposure: Urgent remediation required. Basic ICS hygiene is missing; vulnerable to opportunistic and targeted attacks.

Note: This grade represents cyber resilience against known attack pathways, not a predictive probability that an Iranian actor will specifically target this exact facility.

Critical findings that override the overall score

Regardless of the cumulative score, if any of the following conditions exist, the facility is operating at an unacceptable level of risk and the overall grade defaults to F.

Directly Internet-Facing PLCs/HMIs (Zero Segmentation)
- Why it matters: This is the exact, documented attack vector used by IRGC-affiliated actors in WWS facilities (CISA AA23-335A).
- Evidence: Shodan/Censys scans, firewall perimeter rules.
- Immediate Mitigation: Disconnect the asset from the internet immediately. Place it behind a firewall/VPN.
Default Credentials on Internet-Reachable or Perimeter Assets
- Why it matters: Actors exploit default passwords (1111, admin/admin) to gain initial access and manipulate processes.
- Evidence: Asset configurations, manual login testing.
- Immediate Mitigation: Change passwords to complex, unique credentials immediately.
No Capability for Manual Process Operation
- Why it matters: If a cyberattack renders SCADA inoperable, the inability to run the plant manually means the community loses water service.
- Evidence: Lack of manual SOPs or operator training.
- Immediate Mitigation: Draft emergency manual operation procedures and train operators immediately.
No Offline Backups of PLC Logic and SCADA Configurations
- Why it matters: If threat actors wipe or alter PLC logic, recovery without offline backups requires reverse-engineering the plant's automation from scratch, causing weeks of downtime.
- Evidence: Inability to produce known-good logic files from isolated storage.
- Immediate Mitigation: Execute immediate engineering backups to offline media and secure them physically.

Recommendations by score range

A — Strong Resilience

Focus: Continuous improvement and active defense.
Actions: Implement routine adversary emulation (purple teaming) assuming an initial breach of the IT network. Expand monitoring of east-west OT traffic (e.g., baseline deviations in Modbus or DNP3). Participate actively in WaterISAC threat intelligence sharing.

B — Good Resilience

Focus: Closing specific access and recovery gaps.
Actions: Harden Engineering Workstations against unauthorized logic downloads. Transition all remote vendor access to "just-in-time" privileged access management (PAM). Conduct a physical tabletop exercise simulating the loss of the primary SCADA historian.

C — Moderate Exposure

Focus: Architectural fundamentals and visibility.
Actions: Strictly enforce the IT/OT DMZ (Purdue Level 3.5); eliminate dual-homed machines bridging IT and OT. Audit all VPN configurations to ensure MFA is universally enforced. Verify that an accurate asset inventory exists for Purdue Levels 0-2.

D — High Exposure

Focus: Perimeter defense and incident response readiness.
Actions: Immediately map all external connections; eliminate unauthorized internet pathways. Audit and remove default credentials on all network infrastructure and PLCs. Draft and formally approve an OT-specific Cyber Incident Response Plan.

F — Critical Exposure (Urgent Remediation Plan)

Focus: Maintaining safe water operations and stopping active bleeding.
Immediate (0-72 Hours): Remove all direct OT internet connections. Sever unauthorized vendor remote access. Validate mechanical safety overrides are functional.
Near-Term (3-14 Days): Back up all PLC logic and HMI configurations to offline media. Change all default passwords on PLCs, switches, and firewalls. Implement MFA for all IT/VPN remote access.
Medium-Term (15-60 Days): Segment the network by placing a firewall between corporate IT and the plant network. Baseline the asset inventory.

8. Threat-Informed Interpretation

What this assessment actually tells you about the Iran-linked threat risk:

This assessment does not measure the likelihood of an Iranian attack against your specific facility. Instead, it measures your vulnerability and opportunity profiles.

Opportunistic Attacks: Documented IRGC-affiliated attacks on the water sector have largely been opportunistic, scanning the global internet for specific, vulnerable devices (e.g., Unitronics PLCs on port 20256) and exploiting default passwords. If you score well on perimeter segmentation and identity controls, you effectively eliminate the opportunity for these script-driven, opportunistic campaigns.
Targeted/Pivot Attacks: More sophisticated state-sponsored actors targeting critical infrastructure frequently compromise corporate IT environments first (via phishing or perimeter vulnerabilities) and attempt to pivot. If your IT/OT segmentation is poor (e.g., a "flat network"), a generic IT ransomware attack or espionage campaign can easily spill over into the OT environment, causing operational disruption even if OT was not the primary target.
Cyber-Physical Consequences: By maintaining offline backups and practicing manual plant operations, you decouple cyber vulnerability from physical consequence. Even if a threat actor successfully compromises the HMI, robust mechanical safeguards and trained manual operators ensure that the community's water supply remains safe and continuous.

Summary

Cyber Resilience Assessment: WWS Facility Readiness

Overall Score: ____ / 60 ( ___ % ) | Overall Grade: [ A / B / C / D / F ]

Assessment context

This assessment evaluated the facility’s ability to defend against, detect, and recover from cyberattacks utilizing tactics commonly associated with state-sponsored adversaries and opportunistically targeted ICS threats (such as those outlined in CISA AA23-335A). The evaluation is rooted in IEC 62443 principles and prioritize uninterrupted, safe water operations over IT system availability.

Top Strengths Identified:

[Placeholder: e.g., Mechanical safety relays operate entirely independent of PLCs.]
[Placeholder]
[Placeholder]
[Placeholder]
[Placeholder]

Top Weaknesses Identified:

[Placeholder: e.g., Lack of MFA on remote engineering vendor access.]
[Placeholder]
[Placeholder]
[Placeholder]
[Placeholder]

Critical Findings (Kill Switches):

[If none, state "None observed." If critical findings exist, list them here e.g., "Direct internet routing found to Site B RTU."]

Prioritized Remediation Roadmap:

Immediate Actions (0–30 days):
- Verify offline backups of all critical PLC programming logic.
- Audit external perimeter for any internet-facing OT protocols; block at the firewall.
- Ensure no default credentials exist on internet-reachable VPNs or gateways.
Near-term Actions (31–90 days):
- Review and test the OT Incident Response Plan, specifically the authority to disconnect IT from OT.
- Enforce Multi-Factor Authentication (MFA) for all remote access into the facility.
- Establish a formal inventory of all Purdue Level 1 and 2 assets.
Medium-term Actions (3–12 months):
- Implement an OT DMZ compliant with IEC 62443 to strictly broker traffic between IT and OT.
- Deploy OT-specific network monitoring to detect unauthorized logic changes or abnormal protocol traffic.

Recommended investment priorities:

Focus capital and operational expenditure on architecture (segmentation firewalls), identity (Privileged Access Management for OT), and resilience (OT-specific backup solutions and operator training for manual override).