INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

WaterISAC Identifies Cyber Threats to US Water Systems

| 2026-10-05 10:00 CRITICAL MEDIUM CRITICAL INFRASTRUCTURE & OT
JSON
Executive Summary
AI-generated
The US needs a real plan to defend its water systems, as highlighted in the 2026 Annual Threat Assessment from the U.S. intelligence community, which states that cyber actors from China, Russia, Iran, North Korea, and ransomware groups pose critical threats to U.S. networks and critical infrastructure. The threat is particularly concerning for US water systems, with approximately 450 large and 4,500 medium-sized systems serving a significant portion of the population, but lacking basic cybersecurity capabilities. Advanced AI models have demonstrated the ability to identify thousands of zero-day vulnerabilities in critical software systems, including major operating systems and browsers, allowing attackers to "plan, test, and execute attacks in rapid cycles." The current status is that US water systems are vulnerable due to technical, legal, and practical reasons, with limited authority for the Environmental Protection Agency to impose broad cybersecurity requirements.
Technical Mitigations AI-generated
• Anthropic's Claude Mythos AI model to identify zero-day vulnerabilities in critical software systems • CVE-2022-22963, a known vulnerability in the Apache Log4j library used by many water treatment systems • Zero-trust architecture to block or hunt for lateral movement within water system networks
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
ti•••@cy•••.•••
ti•••••.starks
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Volt TyphoonVolt Typhoon
Target & Sectors
NORTH_AMERICA NORTH_AMERICA DPRK DPRK energyenergy governmentgovernment healthhealth manufacturingmanufacturing technologytechnology
Incident Timeline
‎2026/10/05
The US needs a real plan to defend its water systems due to the mounting cyberattacks on the sector, which have exposed aging systems and vulnerable programmable logic controllers that remain among the easiest ways for adversaries to break in.
threat_actor Volt Typhoon
China’s Volt Typhoon revealed deep Chinese penetration of critical infrastructure, including water systems, that support national security, economic security , and civil society.
organisation The Environmental Protection Agency
Legal: The Environmental Protection Agency lacks clear statutory authority to impose broad cybersecurity requirements on water systems.
organisation Rockwell
The AI specialists should work with major industrial-technology companies, including Siemens, Schneider, and Rockwell, as well as directly with the water systems, both larger and smaller.
organisation American University
Melanie J. Teplinsky is an adjunct professor and senior fellow in the Technology, Law and Security Program at American University (AU), Washington College of Law.
organisation Washington College
Melanie J. Teplinsky is an adjunct professor and senior fellow in the Technology, Law and Security Program at American University (AU), Washington College of Law.
organisation Steptoe & Jonson LLP
She previously practiced technology law at Steptoe & Jonson LLP and served on the pre-IPO advisory board for CrowdStrike.
organisation The Department of Defense
The Department of Defense has certified several companies to provide zero-trust architecture for department components.
organisation Cyber Strategies LLC
Robert J. Butler is the co-founder and managing director of Cyber Strategies LLC, served as the first deputy assistant secretary of defense for space and cyber policy, and served as the Chief Security Officer for IO Data Centers, a global data center enterprise, among other cybersecurity-related roles in both corporate and government organizations.
organisation IO Data Centers
Robert J. Butler is the co-founder and managing director of Cyber Strategies LLC, served as the first deputy assistant secretary of defense for space and cyber policy, and served as the Chief Security Officer for IO Data Centers, a global data center enterprise, among other cybersecurity-related roles in both corporate and government organizations.
organisation National Guard
One model would follow the National Guard approach: State governors would oversee the effort, while the federal government would provide funding.
organisation EPA
In 2023, EPA issued a memo interpreting existing regulations to strengthen the cybersecurity of water systems.
organisation Congress
Not surprisingly, the summer attacks drew attention from the administration and Congress.
organisation Google
AI tools developed by companies including Google and CrowdStrike can identify and help repair software vulnerabilities, a process sometimes called “code mending.”
organisation CrowdStrike
AI tools developed by companies including Google and CrowdStrike can identify and help repair software vulnerabilities, a process sometimes called “code mending.”
organisation Siemens
But much of the software that directs the mechanical operations of water utilities comes from a small group of companies, including Siemens, Schneider, and Rockwell Automation.
organisation Rockwell Automation
But much of the software that directs the mechanical operations of water utilities comes from a small group of companies, including Siemens, Schneider, and Rockwell Automation.
financial $600 sector
Sens. Amy Klobuchar, D-Minn., and Adam Schiff (D-Calif., introduced the Water Safety Shield Act , a bill that would require tiered cybersecurity standards for the water sector and dedicate a proposed $600 million annually to water cybersecurity.
organisation the Water Information Sharing and Analysis Center
Tom Dobbins, executive director of the Water Information Sharing and Analysis Center or WaterISAC, told CyberScoop the sector’s biggest ongoing weaknesses include exposed OT, vulnerable PLCs, insecure connections through integrators and poor cyber hygiene at smaller utilities, which have pushed the center to make threat sharing faster across the sector.
organisation CyberScoop
Tom Dobbins, executive director of the Water Information Sharing and Analysis Center or WaterISAC, told CyberScoop the sector’s biggest ongoing weaknesses include exposed OT, vulnerable PLCs, insecure connections through integrators and poor cyber hygiene at smaller utilities, which have pushed the center to make threat sharing faster across the sector.
organisation OT
Tom Dobbins, executive director of the Water Information Sharing and Analysis Center or WaterISAC, told CyberScoop the sector’s biggest ongoing weaknesses include exposed OT, vulnerable PLCs, insecure connections through integrators and poor cyber hygiene at smaller utilities, which have pushed the center to make threat sharing faster across the sector.
organisation ISAC
The ISAC already has a partnership with the National Rural Water Association to serve 20,000 of the water sector’s smallest utilities, and Dobbins said Cyware would help its analysts further.
organisation the National Rural Water Association
The ISAC already has a partnership with the National Rural Water Association to serve 20,000 of the water sector’s smallest utilities, and Dobbins said Cyware would help its analysts further.
organisation Cyware
The ISAC already has a partnership with the National Rural Water Association to serve 20,000 of the water sector’s smallest utilities, and Dobbins said Cyware would help its analysts further.
organisation The Washington Post
His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly.
organisation POLITICO
His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly.
Tactical Metrics
Metrics
financial
600,000,000
Financial Impact / Stolen Funds
Sens. Amy Klobuchar, D-Minn., and Adam Schiff (D-Calif., introduced the Water Safety Shield Act , a bill that would require tiered cybersecurity standards for the water sector and dedicate a proposed $600 million annually to water cybersecurity.
Intelligence Sources
CyberScoop 2026-10-05
CyberScoop 2026-09-30