Breaking: Iranian-Linked Water Infrastructure Attacks Spread to 12 States — 7 Aug 2026
Iranian-Linked Attacks Hit Water Systems in 12+ States
Water and wastewater systems across at least 12 US states have been compromised in a coordinated campaign attributed to Iranian-affiliated threat actors, likely the IRGC-linked CyberAv3ngers group. The FBI, EPA, and CISA issued a joint advisory on July 30 warning that threat actors were remotely accessing internet-facing operational technology, including Rockwell Automation and Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers. The scope has since expanded from seven states to twelve.
At least one victim organisation had PLC project files modified — the logic governing physical equipment behaviour — not merely a password lockout. Reported effects include pressure loss and flooding conditions that could allow untreated groundwater to enter drinking water distribution pipes. Minnesota alone saw approximately 30 water plants targeted.
The attack vector is straightforward: internet-exposed PLCs with no authentication, no firewalls, and no VPNs. This is the same class of vulnerability CISA has been warning about for years. The difference is scale and intent. This is not opportunistic defacement. Attackers modified process logic on infrastructure serving drinking water.
TeamCity Exploitation Confirmed
JetBrains has confirmed active exploitation of CVE-2026-63077 (CVSS 9.8/10.0), the deserialization vulnerability in TeamCity On-Premises that enables unauthenticated remote code execution via the agent polling protocol. The vendor published additional guidance on August 7 including log indicators: `com.thoughtworks.xstream.converters.ConversionException` entries may indicate successful exploitation, while `ForbiddenClassException` entries suggest blocked attempts on patched servers. Administrators should also check for unauthorised build agents with names starting in "scan".
CISA's patching deadline is August 8. Every TeamCity On-Premises version ever shipped is affected. Cloud instances are not affected.
N-able N-central Attack Chain Deepens
New detail has emerged on the N-able N-central compromise. CVE-2026-18577 is the result of an incomplete fix for CVE-2026-18556 — the initial patch blocked one authentication bypass path, but attackers found another. After gaining administrative access to N-central servers, the threat actors used Take Control to reach managed endpoints and deployed Cloudflare tunnels registered as persistent Windows services to maintain access after the original route was closed. Huntress confirmed at least nine organisations were reached through one compromised MSP partner account.
The six attacker IP addresses published by N-able include Mullvad and NordVPN exit nodes, suggesting operational tradecraft rather than a single infrastructure set. Patch to version 2026.3.1.7. Patching the server is necessary but insufficient — you must also remove Cloudflared services on managed endpoints and review Take Control session logs for activity using N-able support identities.
So what: Three active campaigns demanding your attention this week. The water attacks are the most serious: a nation-state actor modifying process logic on drinking water infrastructure across a dozen states. If you have any role in OT security, this is your wake-up call for internet-facing PLC hardening. For TeamCity, the August 8 CISA deadline is tomorrow — if you have not patched, restrict external access immediately. For N-central, patching alone is not remediation; you need to hunt for persistence on downstream endpoints.