Key takeaways
- US federal agencies issued joint alert AA26-097A in April 2026, naming Iran linked attackers actively exploiting internet facing PLCs across water, wastewater, energy and government services.
- The pattern keeps repeating because the root cause keeps repeating: control systems that are reachable from the public internet when they should not be.
- A defensible architecture is not complicated. It removes public exposure, encrypts remote access from the site outwards, and separates control networks from everything else.
On 7 April 2026, US federal agencies issued joint alert AA26-097A, warning that Iranian affiliated actors are actively exploiting internet facing programmable logic controllers across multiple critical infrastructure sectors. Water and wastewater systems, energy, and government services were all named. Days earlier, the city of Minot in North Dakota disclosed a ransomware incident on its water treatment SCADA server.
If you work in connectivity, security or critical infrastructure, none of this should surprise you. The pattern has been the same for years, and the root cause has barely changed.
Why These Attacks Keep Working
When you read the technical detail behind incidents like these, the story is almost always the same. A PLC, an HMI, or a remote access service has been left reachable from the public internet. Sometimes it is on a default port. Sometimes it has default credentials. Sometimes it has both. Once an attacker reaches it, the rest of the chain becomes much easier.
Water utilities are particularly exposed because they look very different from a corporate IT estate. Treatment plants, pump stations and reservoirs are distributed across wide geographic areas. Engineering teams are small, often shared across multiple sites, and rely heavily on remote access to keep operations running. The temptation to expose just one port, just for now, is real and constant.
The trouble is that there is no such thing as just one port. A single public listener on a critical site is a permanent invitation, and it does not need a sophisticated attacker to find it. Internet wide scanning tools index everything, every day. If a PLC has a public IP, it is in someone’s search index within hours.
The Root Cause Is Architectural, Not Behavioural
A common response to incidents like Minot is to focus on the human element. Patch faster. Change passwords. Train operators. All of this matters, but none of it addresses the underlying problem. If your control system is reachable from the public internet, you are relying on every layer above it being perfect, forever. That is not a defensible position for a treatment plant, a solar farm or a substation.
The architectural answer is simpler than it sounds. No PLC, HMI or NVR should ever be directly reachable from the public internet. Remote access should always happen over an encrypted tunnel that originates from the site, not from the internet inwards. Critical control networks should be logically separated from telemetry, CCTV and corporate traffic. None of this is new thinking. It is the basis of IEC 62443 and a central expectation of NIS2 and the upcoming EU Cyber Resilience Act.
What a Defensible Site Looks Like
A water utility site that follows this pattern looks quite different from a typical install. The control network sits behind a device that does not expose anything to the public internet. Remote engineers and SCADA operators reach the site over an encrypted tunnel that the site itself dials out, not the other way around. The CCTV system and the SCADA system live on separate networks with separate public IPs, so a compromise on one cannot pivot into the other. Connectivity has at least two paths, typically a primary fibre or Starlink link with cellular failover, so a single cable cut or carrier issue does not take the site offline.
This is the architecture Netcelero has been deploying on solar farms, substations and remote monitoring sites for years. The same approach maps cleanly onto water and wastewater.
How Netcelero Fits
The i-ctrl gives the site a fixed static public IP without exposing the control network behind it. Remote access happens over an encrypted management VPN that the i-ctrl itself initiates. Secure Link extends this with full IPSec between the site and the operator’s HQ, ARC or SOC, even over Starlink or cellular where traditional IPSec cannot pass. The dual static IP feature lets a single site keep SCADA traffic and CCTV traffic on logically separate networks, each with its own public IP, so a problem on one side does not cross into the other.
The result is a site that is reachable when authorised users need it, and invisible to everyone else.
What to Do This Week
If you operate or install remote sites with PLCs, HMIs or NVRs, three quick checks are worth doing now.
First, find out which of your sites have any port at all open to the public internet. If any of them are control devices, that is your priority.
Second, look at how remote access works today. If your engineers or your SCADA vendor reach the site by connecting inwards to a public IP, that is the pattern the AA26-097A actors are exploiting.
Third, check whether your CCTV and your SCADA share a network. If they do, plan to separate them. A camera compromise should never be a route into a treatment process.
None of these checks require new investment to start. They do require honest answers, and they will tell you very quickly whether your sites are sitting on the same architecture that keeps appearing in these alerts.
Critical infrastructure cyber security has moved from an abstract concern to a board level priority. If your organisation is reassessing how remote sites are protected, we would welcome the conversation.
Contact us today to learn how Netcelero can give your remote sites a defensible architecture, without adding complexity for your team.
