CVE-2021-22681: Iran-linked CyberAv3ngers Exploit Unpatchable PLC Flaw Against 30+ Minnesota Water Utilities

On 26–27 July 2026, IRGC-linked CyberAv3ngers exploited unpatchable Rockwell Automation Logix PLC flaw CVE-2021-22681 in a coordinated attack on 30+ Minnesota community water systems. Multiple plants were forced to manual operation.

Incident Overview

On 26–27 July 2026, more than 30 Minnesota community water and wastewater systems were hit in a coordinated cyber attack. Automated process-control systems at multiple facilities were disrupted. Some treatment plants were forced to fully manual operation; at least one plant went completely offline. Tenable Threat Research assessed the operational pattern as highly consistent with CyberAv3ngers TTPs (Iran IRGC Cyber-Electronic Command).

Attackers exploited CVE-2021-22681 (CVSS 9.8), a five-year-old publicly disclosed flaw in Rockwell Automation Logix PLCs. No patch exists. Rockwell Automation confirmed the defect is architectural: a shared cryptographic key embedded in engineering software. Fixing it would break compatibility with all deployed Logix PLCs. Four days before the attack (22 July), CISA updated advisory AA26-097A, warning of Iranian-nexus actors targeting Rockwell, Schneider Electric, and Siemens PLCs.

Technical Details

Vulnerability Basics

| Field | Value | |---|---| | CVE ID | CVE-2021-22681 | | CVSS v3.1 | 9.8 (Critical) | | Type | Auth bypass + signature-verification bypass (Logix Designer engineering software) | | Affected component | Rockwell Automation/Allen-Bradley Logix Controllers (CompactLogix, Micro850, others) | | Patch status | No patch (architectural defect; not software-fixable) | | KEV status | Added to CISA KEV catalog March 2026 |

Vulnerability Mechanics

CVE-2021-22681 is an authentication bypass in the communication protocol between Rockwell Automation Studio 5000 Logix Designer and Logix PLCs. Network access to the affected PLC is sufficient (no credentials required):

• Forge authentication credentials: bypass PLC authentication
• Bypass signature verification: defeat project-integrity signing
• Modify ladder logic: directly alter process-control program logic

What makes this CVE distinct:

• Architectural defect: root cause is a shared cryptographic key in the engineering software; cannot be fixed without breaking compatibility with global Logix deployments
• Inherited default credentials: keys extracted from engineering software authenticate to any deployed Logix PLC
• Silent exploitation: successful use leaves no clear intrusion artifacts on the PLC

Attack Timeline

• 2021: Rockwell Automation first disclosed CVE-2021-22681; published security advisory PN1550
• February 2024: U.S. Treasury sanctioned six IRGC-CEC officials; U.S. State Department offered $10 million for CyberAv3ngers intelligence
• March 2026: CVE-2021-22681 added to CISA KEV catalog (confirmed exploited by Iranian-nexus actors)
• 22 July 2026: CISA updated AA26-097A; expanded warnings to Schneider Electric and Siemens devices
• 26–27 July 2026: Coordinated attack on 30+ Minnesota water systems
• 29 July 2026: Tenable, SecurityWeek, and others published incident details

Affected Facilities

| City | Impact | |---|---| | Braham (~1,700) | Computerized process control failed; water plant temporarily shut down; restored in ~2 hours | | Plymouth (~80,000) | Cut cellular links to two water towers and multiple sewage lift stations to stop the attack | | South St. Paul | Partial impact to automated water controls | | Maple Plain | Declared local emergency to expand response authority |

Minnesota Department of Health confirmed drinking-water quality was unaffected at all impacted systems. No boil-water notices issued.

Threat Actor: CyberAv3ngers

CyberAv3ngers is a threat group under Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC), active since at least 2020. Tracked under multiple aliases:

• Storm-0784 (Microsoft)
• Bauxite (Dragos)
• Hydro Kitten
• UNC5691 (Mandiant)
• MITRE ATT&CK G1027

In November 2023 the group targeted 75 Unitronics PLC devices in the U.S. In 2026 TTPs escalated: primary target shifted to Rockwell Logix PLCs. Attack techniques were propagated to 60+ affiliate hacktivist groups via an Electronic Operations Room model.

Impact Assessment

• Critical infrastructure target: water systems are community lifelines; attack directly affects civilian services
• Unpatchable architectural flaw: unfixed for 5 years; all global Rockwell Logix deployments remain continuously exposed
• OT-IT operational constraints: patching in water and similar CI is gated by process uptime (cannot interrupt treatment), regulatory approval, and engineering schedules
• Geopolitical context: amid U.S.–Iran armed conflict, nation-state APT targeting of U.S. critical infrastructure is expected to continue
• Europe equally at risk: AA26-097A explicitly names Rockwell, Schneider, and Siemens as dominant OT platforms in European critical infrastructure

Remediation

Emergency Actions (Highest Priority)

• Disconnect PLCs from direct internet exposure: any Logix PLC with a public IP is exploitable without credentials. Immediate disconnect is the highest-priority control.
• Deploy MFA security gateways: if remote access is operationally required, use a gateway that enforces multi-factor authentication
• Set physical mode switch to Run: blocks remote modification of PLC logic and configuration
• Import CISA IoCs: download STIX indicators from the updated AA26-097A and deploy to SIEM/IDS/firewalls
• Monitor critical ports: especially inbound 44818, 2222, 102, 22, 502 from overseas hosts

Mid-term Hardening

• IT/OT network segmentation: isolate engineering workstations running Studio 5000 Logix Designer, EcoStruxure Control Expert, and TIA Portal
• Deploy allowlisting: permit only authorized workstations to communicate with controllers
• Audit cellular OT links: verify every cellular-connected PLC sits behind a gateway firewall with logging enabled
• Offline backup of PLC logic: copy project files to secure physical media and test restore
• Replace consumer-grade cellular modems: upgrade to industrial cellular gateways that support VPN tunnels and MFA

Strategic

• Bring OT environments into the enterprise zero-trust architecture
• Stand up CI incident-response coordination (CISA, FBI, ISAC)
• Run periodic OT red-team exercises and penetration tests
• Implement PLC project-file integrity monitoring and alerting

Sources

• Tenable: Minnesota Water Coordinated Cyber Attack FAQ
• FBI/CISA/NSA joint advisory: Iranian-nexus actors exploiting PLC vulnerabilities
• TechTimes: Iranian hackers use unpatchable PLC flaw to compromise 30+ Minnesota water systems
• CISA Advisory AA26-097A: Iranian-nexus actors targeting PLCs
• DIESEC: 31 July 2026 top five cybersecurity news