INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Infostealer Exposure in Water Systems via Spear-Phishing Attacks Detected

| 2026-09-22 10:00 CRITICAL LOW DATA BREACH MALWARE & BOTNETS PHISHING & SOCIAL ENGINEERING CRITICAL INFRASTRUCTURE & OT
JSON
Executive Summary
AI-generated
A recent study by identity risk firm SpyCloud has uncovered a wave of cyberattacks targeting U.S. utility metering tenants, with Iran suspected to be the source behind these attacks. The research found that one infected device at a smart meter technology provider contained saved logins linked to roughly 167 different U.S. utility metering tenants, potentially exposing many more organizations. SpyCloud's report revealed that 258 of the 1,787 organizations with active infostealer exposure carried credentials to operational technology or remote-access systems, indicating "cascading supply chain exposure." The study also found that ransomware crews and other fraudsters are seeking access to these logs, which can be used as entry points. SpyCloud has begun a responsible disclosure process for those affected within its report, starting with a briefing for the Cybersecurity and Infrastructure Security Agency. This research highlights the importance of cybersecurity in critical infrastructure sectors such as government and technology, where vulnerabilities can have far-reaching consequences.
Technical Mitigations AI-generated
• Implement multifactor authentication (MFA) to prevent attackers from hijacking authenticated sessions and accessing corporate email or VPNs. • Regularly monitor internet domains for programmable logic controllers (PLCs) and other OT devices, as they can be exploited by cyberattacks. • Conduct vulnerability assessments on systems with active infostealer exposure to identify potential entry points and implement patches or updates to mitigate risks.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope governmentgovernment
Incident Timeline
‎2026/09/22
SpyCloud's report found that 1,787 out of 10,000 examined organizations had active infostealer exposure.
organisation SpyCloud
The study from identity risk firm SpyCloud follows months of reports about a wave of cyberattacks hitting targets in the sector , which U.S. government officials suspect are tied to Iran.
victims 1,787 organizations
It did, however, find that 258 of the 1,787 organizations with active infostealer exposure carried credentials to operational technology or remote-access systems.
The company built a database of 66,845 Environmental Protection Agency-registered systems, examined internet domains and ultimately analyzed 10,000 organizations, finding that 1,787 showed active infostealer exposure.
victims 10,000 organizations
The company built a database of 66,845 Environmental Protection Agency-registered systems, examined internet domains and ultimately analyzed 10,000 organizations, finding that 1,787 showed active infostealer exposure.
organisation CyberScoop
That “cascading supply chain exposure” was one of the biggest findings of the report that SpyCloud shared exclusively with CyberScoop, said Jason Lancaster, chief investigations officer at the cyber firm, along with the quantitative approach” to measure exposure overall.
organisation OT
It’s “important to note that our research did not focus on OT devices which run the most critical processes within these utilities, and any exposure we cite herein should not be interpreted as exposure of specific OT devices,” the report said.
organisation Lancaster
It’s the first study of its kind that SpyCloud has done for a specific industry, so the company doesn’t have comparisons to other industries, Lancaster said.
organisation The Washington Post
His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly.
organisation POLITICO
His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly.
Tactical Metrics
Metrics
victims
1,787
Organizations
It did, however, find that 258 of the 1,787 organizations with active infostealer exposure carried credentials to operational technology or remote-access systems.
The company built a database of 66,845 Environmental Protection Agency-registered systems, examined internet domains and ultimately analyzed 10,000 organizations, finding that 1,787 showed active infostealer exposure.
Metrics
victims
10,000
Organizations
The company built a database of 66,845 Environmental Protection Agency-registered systems, examined internet domains and ultimately analyzed 10,000 organizations, finding that 1,787 showed active infostealer exposure.
Intelligence Sources
CyberScoop 2026-09-22