TLP:GREEN  ·  States / Public Sector
Water Utilities Under Active Attack, Russian Implant Defeats Standard Incident Response:

What State CISOs Must Act On Today

ELEVATED. Raised from GUARDED. FBI and EPA have issued a joint alert confirming cyberattacks on water utility PLCs across seven U.S. states — with physical consequences including pressure loss and flooding. Simultaneously, a Russian intelligence-linked actor is deploying a first-of-its-kind email implant against U.S. government targets that survives password resets and full device reimaging, rendering standard incident response playbooks ineffective. A third campaign delivers fresh high-confidence indicators for a Linux authentication backdoor relevant to any state agency running Linux servers.

I am a
My sector

DevelopmentWhy It Matters for State Government
FBI/EPA Joint Alert: PLC attacks across 7 statesRockwell Allen-Bradley MicroLogix PLCs in water/wastewater systems are being remotely accessed, reprogrammed, and disrupted. Third-party integrators deploying identical configurations amplify the blast radius.
Russian actor TA488 deploys OWAReaper via CVE-2026-42897A JavaScript implant achieves persistent mailbox access that survives credential rotation and device reimaging — a paradigm shift in email compromise. Actively targeting U.S. government.
BANISHEDKITTEN APT: PAMBackdoor IOCs releasedHigh-confidence indicators (confidence 90) for a backdoor that subverts Linux Pluggable Authentication Modules, enabling authentication bypass on Linux servers.
Schneider Electric IGSS SCADA advisory (ICSA-26-211-04)New vulnerability in IGSS Definition module — deployed in state water treatment and building management environments.
Azure Cosmos DB "CosmosEscape" disclosed (patched)Critical flaw could have granted cross-tenant access to any Cosmos DB database. Now fully patched. Awareness item for cloud teams.
Salt Typhoon (Chinese MSS) confirmed in U.S. state agenciesDHS confirmed July 25 that this actor maintains persistent access in multiple U.S. state agencies and National Guard units — assessed as active pre-positioning, not withdrawal.
CVE-2026-20316 (Cisco Secure Firewall) added to CISA KEVStatic credentials enable unauthenticated remote login to Cisco Secure Firewall Management Center. Any state agency using this product must patch immediately.
TeamPCP "Mini Shai-Hulud" supply chain worm open-sourcedSelf-replicating npm/PyPI worm released on criminal forums with cryptocurrency bounty; 323+ packages compromised. Relevant to any state development team using public package repositories.

DateEventSeverity
July 22, 2026TA488/Laundry Bear begins OWAReaper campaign exploiting CVE-2026-42897🔴 Critical
July 25, 2026DHS confirms Salt Typhoon (Chinese MSS) maintains persistent access in multiple U.S. state agencies🔴 Critical
July 27, 2026PLC cyberattacks on water utilities begin across seven states🔴 Critical
July 29, 2026CVE-2026-20316 (Cisco Secure Firewall static credentials) added to CISA KEV🟡 High
July 30, 2026FBI/EPA joint Public Service Announcement on water utility PLC attacks🔴 Critical
July 30, 2026CISA publishes standalone PLC protection directive for water sector🔴 Critical
July 30, 2026Lazarus Group "Operation Double Barrel" disclosed — watering holes linked to ransomware infrastructure🟡 High
July 30, 2026TeamPCP open-sources "Mini Shai-Hulud" supply chain worm on criminal forums🟡 High
July 31, 2026BANISHEDKITTEN PAMBackdoor IOCs published (CrowdStrike, confidence 90)🟡 High
July 31, 2026Schneider Electric IGSS SCADA advisory ICSA-26-211-04🟡 High
July 31, 2026Azure Cosmos DB "CosmosEscape" full disclosure (patched)🟢 Moderate

The FBI and EPA have confirmed a "significant increase" in cyberattacks targeting internet-facing Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 series PLCs in the Water and Wastewater Systems (WWS) sector. Since July 27, attackers have gained remote access to PLCs, modified IP addresses and passwords (locking out legitimate operators), altered ladder logic controlling physical processes, and caused pressure loss and flooding — real-world physical consequences.

The force multiplier: third-party integrators deploying identical network configurations across multiple municipal clients mean a single compromised template propagates vulnerability to every customer. This is supply chain risk applied to operational technology.

State government exposure: any state-managed or state-funded water/wastewater system using MicroLogix 1100/1400 PLCs — particularly those managed by third-party integrators — is in the direct blast radius. These PLCs are end-of-life and no longer receive security updates.

T0831T0836T0855T1190T0883

Russian threat actor Laundry Bear (also tracked as TA488, CL-STA-1114, UNK_PitStop, Void Blizzard) is exploiting CVE-2026-42897 — a cross-site scripting vulnerability in Microsoft Outlook Web Access — to deploy OWAReaper, a browser-based JavaScript implant.

Unlike traditional email compromise, OWAReaper persists through credential rotation and full device reimaging, uses a "half-click" trigger (opening the email compromises the session), and exfiltrates via AES-CTR encrypted HTTPS with DNS tunneling fallback. It achieves persistence through three mechanisms simultaneously: modifying Exchange folder permissions server-side, rewriting browser localStorage/IndexedDB client-side, and stealing OAuth tokens to bypass authentication entirely.

The critical implication for state government: your current incident response playbook for email compromise — "reset password, reimage device, monitor for re-compromise" — is explicitly defeated by this implant. If TA488 targets your OWA environment, standard response will fail to evict them.

T1189T1556T1114.002T1539T1102.001T1071.004

CrowdStrike published high-confidence (90/100) indicators for PAMBackdoor, deployed by the IRGC-affiliated APT group tracked as BANISHEDKITTEN (also known as Cotton Sandstorm). This backdoor targets Linux Pluggable Authentication Modules (PAM) — the core authentication framework on Linux systems — enabling the attacker to authenticate as any user without valid credentials.

State government exposure: any Linux server handling authentication — web application backends, database servers, SCADA HMIs, jump boxes — is a potential target. PAM backdoors are notoriously difficult to detect because they operate at the OS authentication layer, below most EDR visibility.

T1556.003T1078T1059.004
ThreatStatus
Salt Typhoon (Chinese MSS)DHS confirmed Jul 25 persistent access in multiple U.S. state agencies and National Guard units — assessed as pre-positioning, not withdrawal
CVE-2026-20316 (Cisco Secure Firewall)Added to CISA KEV Jul 29 — static credentials enable unauthenticated remote login to Secure Firewall Management Center
TeamPCP "Mini Shai-Hulud"Self-replicating npm/PyPI supply chain worm open-sourced with cryptocurrency bounty; 323+ packages compromised

PredictionProbabilityBasis
CISA adds CVE-2026-42897 (OWA XSS) to KEV within 48 hours>75%Active exploitation against U.S. government confirmed; meets all KEV criteria
Additional states report PLC compromises as FBI investigation expands50-60%Seven states already confirmed; third-party integrator pattern suggests broader exposure
TA488/Laundry Bear expands OWAReaper targeting to state government OWA instances30-40%Currently focused on federal/European targets; state gov is logical expansion
INC Ransomware group pivots to state/local government targeting25-35%$22K bounty announcement signals operational expansion; healthcare/education targeting is adjacent
Salt Typhoon pre-positioned access is leveraged for disruptive action during geopolitical escalation20-30%Access confirmed but no disruptive intent demonstrated yet; contingency capability

Priority 1: OWAReaper Persistence Indicators
What to MonitorATT&CK IDDetection Logic
Exchange folder permission changesT1556Alert on Set-MailboxFolderPermission granting Owner/Editor to "Default" or "Anonymous" on any folder
Unusual Add-MailboxPermission grantsT1556Any permission grant to non-standard delegates, especially bulk grants
OWA localStorage anomaliesT1059.007Browser forensics: Base64 blobs >10KB in localStorage for OWA sessions
GitHub API C2 trafficT1102.001Outbound HTTPS to api.github.com/search/commits from Exchange/OWA servers
DNS tunneling exfiltrationT1071.004Anomalous DNS query volume or unusually long DNS labels from Exchange infrastructure

Hunting Hypothesis: "If TA488 has compromised our OWA environment, we will observe Exchange audit logs showing Default user permission escalation on mailbox folders, combined with outbound GitHub API queries from Exchange servers."

Priority 2: PLC/OT Integrity Monitoring
What to MonitorATT&CK IDDetection Logic
Internet-facing PLC connectionsT0883Network scan for any MicroLogix 1100/1400 with public IP or NAT exposure
PLC configuration changesT0836Compare current PLC IP addresses, passwords, and ladder logic against known-good baselines
Unauthorized PLC commandsT0855Monitor for EtherNet/IP CIP commands from non-authorized source IPs

Hunting Hypothesis: "If our water/wastewater PLCs have been compromised, we will observe ladder logic modifications, IP address changes, or password lockouts on MicroLogix devices — particularly those managed by third-party integrators."

Priority 3: Linux PAM Integrity
What to MonitorATT&CK IDDetection Logic
PAM module file modificationsT1556.003File integrity monitoring on /lib/security/.so and /etc/pam.d/ — compare against package manager checksums (rpm -V or dpkg --verify)
Unexpected authentication successesT1078Alert on successful SSH/sudo authentication for accounts with no corresponding password entry or key-based auth configured
PAMBackdoor hashesT1556.003EDR/SIEM hash match against known indicators (see IOC table below)

Hunting Hypothesis: "If BANISHEDKITTEN has deployed PAMBackdoor on our Linux infrastructure, we will observe modified .so files in /lib/security/ that do not match vendor package checksums, potentially accompanied by authentication successes for dormant or service accounts."

IOC Blocking Table:
publicnode[.]comdns[.]multitoconference[.]commultitoconference[.]comtajikistandip[.]comclouddevicemetrics[.]commdpsupport[.]netannoyingremote[.]comblsouqs[.]comssentialserv[.]xyzgycudore[.]kozow[.]comctyuhjerf[.]kozow[.]com

All domains above (except publicnode[.]com, which is a blockchain RPC endpoint tied to the ClearFake/EtherHiding campaign and should be monitored/investigated rather than blocked outright) are confirmed APT C2 infrastructure — block + alert. PAMBackdoor hashes (BANISHEDKITTEN): MD5 c10ccf8fd0c116ebb771ea312540fd5a, MD5 05076c9c2e82a93d79e7fd534de7523b, SHA-1 7d16338cb66fee6be14f3051d811182fa874782e, SHA-1 2486b9d55992d94a1bcc9c9337644579df408892 — block + alert. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.

Hunting Hypotheses:
HUNT 01 · T1556
OWAReaper persistence via Exchange permissions
If TA488 has compromised our OWA environment, we will observe Exchange audit logs showing Default user permission escalation on mailbox folders, combined with outbound GitHub API queries from Exchange servers.
HUNT 02 · T0836
PLC/OT integrity compromise
If our water/wastewater PLCs have been compromised, we will observe ladder logic modifications, IP address changes, or password lockouts on MicroLogix devices — particularly those managed by third-party integrators.
HUNT 03 · T1556.003
Linux PAM backdoor presence
If BANISHEDKITTEN has deployed PAMBackdoor on our Linux infrastructure, we will observe modified .so files in /lib/security/ that do not match vendor package checksums, potentially accompanied by authentication successes for dormant or service accounts.

Financial Services
State Treasury, Revenue, Benefits Systems
Primary threats
OWAReaper targeting email systems containing financial transaction approvals, wire transfer authorizations, and taxpayer data
Secondary threat
Credential theft via ClearFake/EtherHiding campaign targeting state financial portals
Actions
  • Audit all Exchange/OWA mailbox permissions for treasury and revenue staff
  • Implement conditional access policies restricting OWA to managed devices only
  • Enable enhanced audit logging for mailbox delegation changes
Energy
State-Managed Utilities, Grid Coordination
Primary threat
PLC attacks on water/wastewater — directly applicable to any state-managed energy SCADA using similar Rockwell/Allen-Bradley controllers
Secondary threat
Schneider Electric IGSS vulnerability in building management and SCADA monitoring systems
Actions
  • Conduct immediate internet-exposure audit of ALL OT devices
  • Verify network segmentation between IT and OT
  • Confirm hardware key switches are in RUN mode on all critical PLCs
  • Establish manual operation capability for essential processes
Healthcare
State Health Agencies, Medicaid Systems
Primary threat
Ransomware (INC Ransom actively targeting healthcare sector; state health agencies hold massive PII/PHI datasets)
Secondary threat
OWAReaper targeting health agency email containing PHI and inter-agency communications
Actions
  • Verify offline backup integrity for Medicaid enrollment, claims processing, and EHR systems
  • Conduct tabletop exercise for ransomware scenario affecting benefits processing
  • Monitor for INC Ransom TTPs (ADFind, NetScan reconnaissance tools)
Government
Executive Branch, Public Safety, Courts
Primary threat
Salt Typhoon persistent access (confirmed in U.S. state agencies); OWAReaper targeting government OWA
Secondary threat
BANISHEDKITTEN PAMBackdoor targeting Linux authentication infrastructure (court systems, public safety databases)
Actions
  • Conduct enterprise-wide hunt for Salt Typhoon indicators (ORB network patterns)
  • Prioritize CVE-2026-42897 patching for all government OWA instances
  • Audit PAM configurations on Linux servers hosting government applications
Aviation / Logistics
State DOT, Port Authorities, Emergency Management
Primary threat
Supply chain compromise via TeamPCP "Mini Shai-Hulud" worm affecting CI/CD pipelines for transportation management systems
Secondary threat
PLC attacks potentially expanding beyond water to traffic management and port control systems using similar Rockwell controllers
Actions
  • Pin all GitHub Actions to commit SHAs
  • Audit npm/PyPI dependencies in transportation and logistics applications
  • Implement package integrity verification in CI/CD pipelines

Verify patching status of CVE-2026-42897 across all Exchange/OWA instances. If unpatched, disable OWA Classic UI immediately as interim mitigation.
SOC AnalystIAM Analyst
Confirm ALL Rockwell Allen-Bradley MicroLogix 1100/1400 PLCs in state water/wastewater systems are NOT internet-accessible. Verify hardware key switches in RUN mode. Validate ladder logic against known-good backups.
ICS / OT
Ingest BANISHEDKITTEN PAMBackdoor hashes into EDR/SIEM blocklists. Hunt for modified PAM modules on Linux servers.
SOC AnalystThreat Hunter
Audit Exchange folder permissions enterprise-wide for unexpected "Default" user Owner-level access grants (OWAReaper persistence indicator).
IAM Analyst
Contact third-party water/wastewater integrators to confirm their PLC deployment templates are secured and not using default configurations.
ICS / OTCISO / Exec
Verify CVE-2026-20316 (Cisco Secure Firewall static credentials) is patched on all Cisco Secure Firewall Management Center instances.
SOC Analyst
No immediate actions for the selected roles.
Apply Schneider Electric IGSS Definition module patch per ICSA-26-211-04. Verify IGSS instances are network-segmented from corporate IT.
ICS / OT
Scan all state-operated WordPress sites for injected scripts containing Base64 payloads or references to BSC testnet RPC endpoints (ClearFake/EtherHiding campaign).
SOC Analyst
Audit Azure Cosmos DB configurations — confirm no Gremlin API endpoints are exposed. Review access logs for anomalous cross-tenant queries.
IAM Analyst
Implement detection rule for Set-MailboxFolderPermission changes granting Owner to Default/Anonymous (OWAReaper persistence).
Threat Hunter
Conduct enterprise-wide Salt Typhoon indicator hunt across state agency networks, focusing on ORB network patterns and lateral movement from previously confirmed access points.
SOC AnalystThreat Hunter
Audit npm/PyPI dependencies in all state CI/CD pipelines for packages compromised by Mini Shai-Hulud worm. Pin GitHub Actions to commit SHAs.
Threat Hunter
No 7-day actions for the selected roles.
Update IR playbooks to account for OWAReaper-class persistence: add Exchange server-side permission audit, browser localStorage/IndexedDB forensics, and OAuth token revocation as mandatory response steps.
CISO / ExecIncident Responder
Develop replacement plan for end-of-life Allen-Bradley MicroLogix 1100/1400 PLCs per FBI/EPA recommendation. These devices no longer receive security updates.
ICS / OTCISO / Exec
Commission assessment of all third-party OT integrators managing state water/wastewater systems — evaluate their security posture and deployment standardization practices.
CISO / Exec
Establish alternative legislative/policy monitoring feeds (Congressional/NCSL RSS) to compensate for OSINT collection gaps affecting cybersecurity legislation tracking.
Threat Hunter
Conduct tabletop exercise simulating simultaneous OT disruption (water utility) and email compromise (OWAReaper) to test cross-domain incident response coordination.
CISO / ExecIncident Responder
Brief the Governor's office on the FBI/EPA water utility alert — this has potential for constituent impact and media attention if a state-managed system is affected.
CISO / Exec
Pre-position public communications for potential water utility cyber incident disclosure.
CISO / Exec
Confirm cyber insurance coverage explicitly addresses OT/ICS incidents and nation-state attribution scenarios.
CISO / Exec
Validate mutual aid agreements with adjacent states and MS-ISAC for surge incident response capacity.
CISO / Exec
No 30-day actions for the selected roles.
The Bottom Line

The threat landscape facing state government this week is defined by two uncomfortable realities: physical infrastructure is being actively disrupted across multiple states, and a sophisticated nation-state actor has developed an email implant that defeats our standard incident response procedures. The common thread across all three threats is that default assumptions are failing — default PLC configurations are being exploited, default incident response ("reset and reimage") is being defeated, and default trust in third-party integrators is being weaponized. The adversaries are not waiting. Neither should we.

1
Is your PLC internet-exposure audit done? Seven states are already confirmed compromised — assume you're in the blast radius until proven otherwise.
2
Is CVE-2026-42897 patched on every OWA instance? OWAReaper defeats "reset and reimage" — your standard IR playbook will not evict it.
3
Have you ingested the PAMBackdoor hashes? A Linux authentication bypass operating below EDR visibility is already targeting government infrastructure.
No items found.