FBI, CISA warn water facility operators of ongoing malicious cyber activity

Incidents occurred in Kansas, California, Maine, Nevada and New Jersey.

Ransomware attackers are continuing to target water and wastewater facilities, U.S. intelligence and law enforcement officials warned in a bulletin based on incidents in five states.

A cybersecurity advisory published Thursday from the FBI, the Cybersecurity Infrastructure and Security Agency, the Environmental Protection Agency and the National Security Agency highlighted incidents in five states between March of 2019 and August 2021, where systems were targeted by either ransomware attacks or other hacks. In one case, a former employee of a Kansas-based facility tried to “threaten drinking water safety by using his user credentials…to remotely access a facility computer,” according to the alert.

Other incidents occurred in California, Maine, Nevada and New Jersey.

The notice pointed to “ongoing malicious cyber activity — both by known and unknown actors,” targeting information technology and operational technology networks, systems, and devices.

“Recent ransomware incidents and ongoing threats demonstrate why all critical infrastructure owners and operators should make cybersecurity a top priority,” said Eric Goldstein, the executive assistant director for cybersecurity at CISA.

The list did not include a February 2021 attack at a water treatment facility in Oldsmar, Fla., where an intruder broke into the facility’s computer system and temporarily changed the plant’s sodium hydroxide level. A plant worker reversed the change before the levels changed to an unsafe level, officials said.

The attack was one of two that day, according to industrial security firm Dragos, which reported that the facility’s network suffered an intrusion as part of a botnet targeting “dozens” of other water companies.

The notice Thursday reported that water facilities could be vulnerable to common tactics such as spearphishing, exploitation of outdated or unsupported operating systems and softare, and the exploitation of control system devices with vulnerable firmware versions. A February CISA notice cited poor password security and an outdated operating system as part of the Oldsmar sodium hydroxide situation.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure