Coordinated “cyberattack” on Minnesota water utilities: What you need to know

Sicherheitsmeldung mit Schweregrad kritisch (CVSS 9.8). Sie wird laut CISA-KEV aktiv ausgenutzt und sollte priorisiert behandelt werden. Betroffene Kennungen: CVE-2021-22681, CVE-2023-3595, CVE-2024-6242. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

A coordinated cyber attack disrupted water systems across more than 30 Minnesota communities. Here is what defenders need to know about the attack so far. This FAQ also details recent cyberactivity targeting internet-exposed PLCs, and how to protect exposed infrastructure.Key TakeawaysA coordinated "cyberattack" targeted water and wastewater systems across more than 30 Minnesota communities on July 26-27, 2026; attribution remains pending a federal investigation, though the timing aligns closely with escalating Iranian-affiliated PLC exploitation activity documented in CISA Advisory AA26-097A.The July 22, 2026 update to CISA Advisory AA26-097A expanded the scope of observed PLC exploitation to include Schneider Electric and Siemens devices alongside Rockwell Automation, documented project file exfiltration for the first time, and added detection guidance for manipulation of reusable code modules embedded in PLC programs.CVE-2021-22681 (CVSS 9.8), a critical authentication bypass in Rockwell Automation Logix controllers with no available vendor patch, was added to CISA's Known Exploited Vulnerabilities catalog in March 2026 following confirmed exploitation by Iranian-affiliated actors.BackgroundTenable's Research Special Operations (RSO) team has compiled this FAQ in response to the coordinated cyber attack against Minnesota water utilities and the July 22, 2026 update to CISA Advisory AA26-097A.On April 9, 2026, we published a comprehensive FAQ about CyberAv3ngers, the IRGC-linked group at the center of the PLC exploitation activity documented in CISA Advisory AA26-097A. …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen (CVE-2021-22681, CVE-2023-3595, CVE-2024-6242): Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know
• Priorität HOCH: laut CISA-KEV aktiv ausgenutzt – bevorzugt patchen.
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.
• Erkennung: Logs und Indikatoren (IoCs) auf Ausnutzung prüfen.