Executive Summary

The dominant story of the week was the continued spread of an Iran-linked intrusion campaign against U.S. water utilities, which grew from an initial cluster of Minnesota incidents in late July to confirmed activity in at least twelve states, with Georgia and Michigan disclosing new cases and researchers finding thousands of exposed Rockwell Automation controllers nationwide. CISA and the FBI updated their joint advisory to note the attackers have moved beyond Rockwell’s Allen-Bradley MicroLogix line to target Schneider Electric Modicon and Siemens S7-1200 controllers as well, exploiting a long-known Studio 5000 Logix Designer authentication bypass and, in at least one case, deploying Dropbear SSH for persistent remote access. Elsewhere, CISA’s August 4 and August 6 advisory batches covered a hardcoded Bluetooth key in an automotive anti-theft system, missing integrity checks on forensic DNA sequencer output files, and an end-of-life MongoDB component quietly bundled inside ABB’s widely deployed zenon SCADA and HMI platform.

This report focuses on Cyber-Physical Systems (CPS), Industrial Control Systems (ICS), and critical infrastructure security.

Week of July 31 - August 7, 2026

Critical Alerts & Advisories

CISA published four ICS advisories this week across two batches, on August 4 and August 6, alongside a continuing update to its Iran-focused critical infrastructure advisory first issued in April.

The automotive-facing advisory, ICSA-26-216-01, disclosed CVE-2026-18411 in Acrisure’s KARR Bluetooth security system and DR-100 dealer-installed anti-theft device, scored CVSS 8.1. The flaw, classified as CWE-321 for use of a hardcoded cryptographic key, means every affected unit shares the same Bluetooth authentication secret, so an attacker within radio range of any single vehicle can issue unauthorized commands to unlock doors or immobilize the engine on any other vehicle running the same firmware. Acrisure Protection Group shipped a fix on July 20, and owners of KARR BT and DR-100 hardware should apply it through the vendor’s firmware update process without delay.

A companion medical device advisory, ICSMA-26-216-01, addressed CVE-2026-17583 in a broad swath of Thermo Fisher’s Applied Biosystems genetic analyzer software, scored CVSS 8.4. The affected data collection and analysis packages, spanning current SeqStudio and 3500 series instruments down to legacy 3100 and 310 platforms, lacked integrity verification on the .fsa and .hid output files that carry raw capillary electrophoresis data. An attacker able to tamper with these files after collection could silently corrupt DNA sequencing results, a concern that extends beyond clinical diagnostics into forensic laboratories that rely on the same instrument family for evidentiary sample analysis. Thermo Fisher’s patches add digital signatures to verify file integrity, though several end-of-life instrument models will not receive an update.

CISA’s August 6 batch brought ICSA-26-218-01 for ABB’s Ability zenon IIoT Services, which bundles an end-of-life MongoDB 4.2 instance as its persistence engine. ABB disclosed thirteen unpatched vulnerabilities inherited from that abandoned MongoDB build, the most severe being CVE-2025-14847, known as MongoBleed, which carries a CVSS v4.0 score of 8.7 and lets an unauthenticated client read uninitialized heap memory from the database process due to a zlib decompression length-reporting bug. Zenon is deployed as an HMI and SCADA layer across energy, water, food and beverage, pharmaceutical, and automotive process lines, and only installations with IIoT Services enabled carry the exposure. The companion ICSA-26-218-02 covered Johnson Controls’ TL280 access control panel, where CVE-2026-27871 hardcodes authentication credentials into firmware prior to version 5.63, a medium-severity issue that nonetheless spans critical manufacturing, commercial facilities, government, transportation, and energy deployments worldwide.

Water & Wastewater Sector

The intrusion campaign against U.S. water utilities that began surfacing in Minnesota around July 27 continued to widen through the week. Michigan’s Department of Environment, Great Lakes, and Energy confirmed nine water systems had reported suspicious activity, and Georgia acknowledged affected utilities without releasing details, bringing the confirmed count to at least twelve states according to Forescout’s independent scan-based analysis, well beyond the seven states the FBI and EPA had named in their initial notice. Both states emphasized that operators caught the intrusions before any public health impact occurred, echoing the pattern from the original Minnesota cases where attackers changed IP addresses and passwords on internet-exposed controllers to lock operators out, in some cases triggering brief pressure drops rather than sustained outages.

Forescout’s scan of internet-facing Rockwell Automation equipment found 4,407 exposed controllers worldwide, 2,844 of them in the United States, with the MicroLogix 1400 and 1100 families accounting for the large majority. Twenty-two of those exposed devices sat in cities where confirmed attacks occurred, and more than seventy percent of the U.S. exposure rode on cellular carrier networks from Verizon Business, AT&T, and T-Mobile, reflecting how field-deployed PLCs at pump stations and lift stations reach the internet through cellular modems that assign them public addresses by default. The exposed EtherNet/IP service on port 44818 required no vulnerability at all in many cases; if a controller answered on the internet, the protocol’s unauthenticated management functions were often sufficient to read or rewrite its configuration.

CISA and the FBI’s updated joint advisory, an extension of the AA26-097A alert first issued in April and revised July 22, confirmed the threat actors have broadened their target set beyond Rockwell hardware to Schneider Electric BMX P34 and Modicon M340 controllers and Siemens S7-1200 series PLCs. The exploited entry point in several confirmed cases traces back to CVE-2021-22681, a five-year-old authentication bypass in Rockwell’s Studio 5000 Logix Designer engineering software carrying a CVSS score of 9.8, which CISA had already added to its Known Exploited Vulnerabilities catalog in March after Rockwell confirmed active exploitation. In at least one intrusion, attackers deployed Dropbear SSH server software onto a compromised system to maintain durable remote access, and the updated advisory also documented, for the first time in this campaign, exfiltration of PLC project files and manipulation of reusable code modules embedded within them, a technique that suggests longer-term reconnaissance of control logic rather than purely opportunistic disruption. No U.S. agency has formally attributed the campaign, though the technical pattern, absence of ransom demands, and focus on operator lockout rather than data theft closely track prior CyberAv3ngers operations.

The campaign sits against the backdrop of a separate June incident in which Iran-linked group Handala claimed to have breached California Water Service, leaking roughly 5GB of customer billing records and GPS correction network data spanning the utility’s Bakersfield, Chico, Salinas, Stockton, Visalia, and San Mateo service areas. Cal Water confirmed the IT-side breach but stated no operational technology systems controlling water treatment or distribution were compromised, and independent researchers found nothing in the leaked data supporting Handala’s claim of being able to disrupt water delivery. The EPA separately disclosed in February that it had proactively identified cybersecurity weaknesses at 277 water systems nationwide, underscoring how widespread basic exposure remains across the sector even before this summer’s active intrusion campaign began.

Energy & Power Grid

The expansion of the PLC intrusion campaign into Schneider Electric and Siemens equipment carries direct relevance for the energy sector, since both vendors’ controller families are widely deployed in distribution automation and substation environments alongside their water sector footprint. The Johnson Controls TL280 and ABB zenon advisories disclosed this week likewise touch energy infrastructure, with zenon in particular serving as an HMI and SCADA layer on process lines where an unauthenticated memory-disclosure bug in a bundled database component could expose operational data without any need to compromise the control logic itself.

Automotive CPS Security

The Acrisure KARR advisory disclosed this week illustrates a recurring automotive aftermarket security failure: shared cryptographic secrets baked into every unit of a product line, rather than device-specific keys, mean a single extracted credential compromises the entire installed base. Because the KARR and DR-100 systems are dealer-installed anti-theft devices rather than factory equipment, the vulnerability sat outside the visibility of the vehicle manufacturers whose cars carry it, a gap that continues to complicate coordinated disclosure across the aftermarket automotive security supply chain.

Medical Device CPS Security

The Thermo Fisher Applied Biosystems advisory extends this year’s pattern of cybersecurity findings reaching into laboratory and diagnostic instrumentation rather than only patient-connected devices. Because the affected genetic analyzer software spans instruments used in both clinical diagnostics and forensic casework, the lack of integrity verification on output files raises questions beyond patient safety, into the evidentiary reliability of DNA test results generated on unpatched legacy instruments that will not receive Thermo Fisher’s signature-based fix.

Manufacturing & Industrial

The ABB zenon and Johnson Controls TL280 advisories both carry direct manufacturing exposure given the breadth of sectors each product touches, from critical manufacturing and commercial facilities to food and beverage and pharmaceutical production lines. The zenon case in particular highlights a governance failure common across the ICS supply chain: vendors bundling general-purpose open source components, in this instance a database engine, without a plan for what happens when that component reaches end of life and stops receiving upstream security patches, leaving thirteen accumulated vulnerabilities with no path to remediation short of removing the dependency entirely.

Threat Intelligence Highlights

The water sector campaign’s technical evolution this week, from simple credential-based lockouts to project file exfiltration and manipulation of reusable code modules, mirrors a broader trend Dragos and other OT threat intelligence firms have tracked through 2026: state-aligned actors moving from opportunistic device targeting toward systematic mapping of control logic, positioning for either sustained intelligence collection or future disruptive action. The Dropbear SSH persistence technique observed in this campaign is a low-cost, widely available tool that requires no custom malware development, consistent with an actor prioritizing operational simplicity and deniability over sophistication. The disputed political reaction to the campaign, including public statements attributing the incidents to domestic political rivals rather than the technical evidence pointing toward Iran-affiliated actors, illustrates how attribution in OT incidents increasingly plays out in a contested public arena even as the underlying exploitation techniques remain well understood by defenders.

Defensive Recommendations

Water and wastewater utilities operating Rockwell MicroLogix, Schneider Modicon or BMX P34, or Siemens S7-1200 controllers should immediately audit for internet exposure, particularly on cellular modem connections at remote pump and lift stations, and remove direct internet reachability regardless of whether authentication is enabled. Organizations still running Studio 5000 Logix Designer without the CVE-2021-22681 mitigation should apply Rockwell’s guidance immediately, as this five-year-old flaw remains the confirmed entry point for active exploitation. Monitor for unauthorized SSH services, including Dropbear, running on engineering workstations and HMI systems, and audit PLC project files for unauthorized modifications to reusable code modules.

Acrisure KARR BT and DR-100 owners should apply the July 20 firmware update through the vendor’s instructions without delay, given the shared-key design means any single compromised unit threatens the entire installed base. Laboratories running Thermo Fisher Applied Biosystems genetic analyzers should update to the signature-verifying software releases where available, and treat output files from end-of-life instruments that cannot be patched as requiring manual chain-of-custody verification. ABB zenon operators with IIoT Services enabled should isolate the MongoDB-backed persistence service from untrusted network access and evaluate migration paths off the end-of-life database component, since no further upstream patches will arrive for its thirteen disclosed vulnerabilities. Johnson Controls TL280 deployments should update to firmware 5.63 and rotate any credentials derived from the hardcoded values.

News Summary week 32, 2026