Skip to content

2026 U.S. Water Utilities Attacks

Campaign · ATTACK:ics:C0066

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:C0066",
  "title": "2026 U.S. Water Utilities Attacks",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0066",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--5cae2d7e-ce03-4a20-b7a7-32e846d26121",
  "external_id": "C0066",
  "domain": "ics",
  "created": "2026-10-08T21:32:18.464Z",
  "modified": "2026-10-13T14:29:13.954Z",
  "version": "1.0",
  "aliases": [
    "2026 U.S. Water Utilities Attacks",
    "2026 Water Utilities Attacks"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "FBI Water and Wastewater",
      "url": "https://www.fbi.gov/investigate/cyber/alerts/2026/malicious-cyber-actors-targeting-water-and-wastewater-sector-internet--facing-programmable-logic-controllers-causing-operational-disruptions"
    },
    {
      "source_name": "Dragos Water Under Attack",
      "url": "https://www.dragos.com/blog/water-utility-attacks-decade-of-gaps"
    },
    {
      "source_name": "Tenable Minnesota Water Utilities",
      "url": "https://www.tenable.com/blog/coordinated-cyberattack-on-minnesota-water-utilities-what-you-need-to-know"
    },
    {
      "source_name": "Forescout Water Systems Attack",
      "url": "https://www.forescout.com/blog/ot-security-analysis-exposed-devices-attacked-in-us-water-systems/"
    }
  ]
}

Explicit source assertions (9)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:C0066 → uses → ATTACK:ics:T0813

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19dee45d-8c24-41ac-976f-aeb221c4f658

Dragos Water Under Attack · Tenable Minnesota Water Utilities · Forescout Water Systems Attack

ATTACK:ics:C0066 → uses → ATTACK:ics:T0892

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c479e7e-422c-4329-8fb9-4484e2fdbf9c

FBI Water and Wastewater · Dragos Water Under Attack · Tenable Minnesota Water Utilities · Forescout Water Systems Attack

ATTACK:ics:C0066 → uses → ATTACK:ics:T0829

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50a10bc7-950b-4a12-aeaf-52a7b013efc2

FBI Water and Wastewater · Dragos Water Under Attack · Tenable Minnesota Water Utilities · Forescout Water Systems Attack

ATTACK:ics:C0066 → uses → ATTACK:ics:T1694.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7050acd5-637b-4581-b58e-dcfac3eb1bb5

Tenable Minnesota Water Utilities

ATTACK:ics:C0066 → uses → ATTACK:ics:T0827

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--862d5dbb-4582-4a9b-877a-e323233b53fe

FBI Water and Wastewater · Dragos Water Under Attack · Tenable Minnesota Water Utilities · Forescout Water Systems Attack

ATTACK:ics:C0066 → uses → ATTACK:ics:T0836

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce4d77f4-6b9f-435f-94ca-52bc4a90522b

FBI Water and Wastewater · Dragos Water Under Attack · Tenable Minnesota Water Utilities · Forescout Water Systems Attack

ATTACK:ics:C0066 → uses → ATTACK:ics:T0826

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0152ca1-4ad2-4dce-9231-cad70c802d62

FBI Water and Wastewater · Dragos Water Under Attack · Tenable Minnesota Water Utilities

ATTACK:ics:C0066 → uses → ATTACK:ics:T0889

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e060820a-5a37-4abe-b27e-e157f2d6fa27

FBI Water and Wastewater · Tenable Minnesota Water Utilities · Forescout Water Systems Attack

ATTACK:ics:C0066 → uses → ATTACK:ics:T0883

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef91b940-b3ea-4403-ba03-c71b8dcc8763

FBI Water and Wastewater · Tenable Minnesota Water Utilities · Forescout Water Systems Attack

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.