The wave of intrusions follows a playbook that has been developing since 2023, when CyberAv3ngers first targeted Israeli-made Unitronics PLCs and began defacing them with pro-Iran messages. By 2025 the group had pivoted to Rockwell Automation PLCs, exploiting an authorisation bypass vulnerability that cannot be patched. Defenders have few options beyond the defence-in-depth measures the FBI now recommends in the absence of a permanent fix.
More than 50,000 drinking water and wastewater systems operate across the US, many serving small communities with limited cybersecurity staffing. The majority still rely on internet-connected industrial control systems for remote management, creating a large and heterogeneous attack surface that no single patch cycle can close.
The threat has expanded significantly. CyberAv3ngers' IOControl malware has now been distributed to at least 60 Iran-affiliated hacking groups, according to researchers, which means security teams can no longer track one actor's tactics, techniques and procedures and consider themselves prepared. Dozens of groups may now be capable of deploying modified variants of the same underlying toolkit.
There is also an AI dimension. Researchers have documented the group using ChatGPT for code debugging and research, suggesting the malware will continue to grow more sophisticated. That trajectory matters because water system disruption does not require physical damage to achieve its objectives.
Schappert notes: "Attackers don't have to poison a water supply or leave an entire city without service to achieve an effect. They just have to make people wonder: Is my drinking water safe? Even an unsuccessful attempt at disruption can shake public trust — and with headlines that stretch across the internet, the psychological effect can reverberate across an entire nation."
The economics of critical infrastructure attacks make water systems an enduring target. Every community depends on water, alternatives are non-existent when systems fail, and the psychological return on a successful intrusion far exceeds the technical investment required to carry one out. Municipalities with the fewest resources to spend on cybersecurity are the ones most exposed.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
