CISA Says Undocumented Cellular Modems Are How Attackers Reached Water Utilities. Here Is What That Looks Like in the Data.

CISA issued an alert on 30 July about attacks disrupting US water and wastewater systems, after more than thirty Minnesota community utilities were hit. Attackers reached internet-exposed programmable logic controllers, changed passwords to lock operators out, and altered device IP addresses. Some plants went to manual operation.

The alert names the exposure path, and it is the most useful sentence in it:

undocumented cellular modems installed by operators, vendors, or system integrators

Nearly half of exposed Rockwell devices, per the Censys figures cited alongside it, are reachable through ordinary consumer and business carriers — Verizon, AT&T, T-Mobile, Comcast, Charter, Starlink. Not a leased line into a plant. A modem in a cabinet.

We spent this week measuring a different slice of the same problem, from public scan data, before that alert existed. We arrived at the same mechanism. What we can add is its shape — because "undocumented cellular modems installed by integrators" describes a category, and a category is hard to go looking for.

What the fingerprint looks like

Three things fall out of it.

Carriage is cellular, overwhelmingly. 24 of 34 sit on one business carrier. These are not plants that forgot a firewall rule; they are remote sites on an LTE link that somebody assumed was private because it wasn't plugged into anything.

Hosts are not sites. Six locations account for fifteen of the thirty-four controllers — adjacent addresses, same site, multiple PLCs. Counting exposed hosts materially overstates how many operators are involved, which matters if you are trying to work out how big the problem is.

And the exposure clusters by installer, not by operator. Seven commissioning signatures cover twenty-one of the thirty-four. One engineering workstation name and one shared-drive path appear across four unrelated customers in three states. Another installer's virtual-machine shared folder appears on two. These are not twenty-one independent mistakes. They are a handful of practices, repeated faithfully at every site that installer touches.

We have anonymised all of it deliberately. These are exposures, not indicators, and the operators did nothing wrong — the pattern lives upstream of them.

Why that changes what you go looking for

CISA's mitigations are correct and you should do all of them: remove the PLC from direct internet exposure, put a VPN or gateway in front if remote access is genuinely required, change default passwords, restrict by IP allow-list.

But every one of those is something you do to your site. The clustering says the decision that exposed you was probably made by somebody else, at commissioning, and repeated at four other places you have never heard of.

So two questions are worth more than another firewall review:

"Is there a cellular modem in my cabinet that I did not order?" Not on the drawing — in the cabinet. CISA's word is undocumented, and undocumented means it will not be on your asset register or your network diagram. Go and look at the hardware.

"Does your standard commissioning leave the controller reachable, and does your project naming embed a workstation path?" Ask your integrator directly. If the answer to the first is yes, every site they have built has the same problem, including the ones that have not been attacked yet.

That second question is the leverage. One conversation with an installer fixes more sites than any number of individual notifications.

The check that is not in the alert

Everything in CISA's mitigation list is about reachability — removing it, tunnelling it, filtering it. None of it addresses what the controller volunteers once something does reach it.

Ask your own device to identify itself, from outside your perimeter. Modbus on 502, EtherNet/IP on 44818, S7comm on 102. It costs nothing and takes an afternoon.

If the reply contains a project name, an engineering workstation name, or a filesystem path, you are serving free reconnaissance. In the set we measured, thirty-four US controllers do exactly that, and twenty-one of them name an owner, a site or an installer. Several name the engineer's laptop and the network share the control logic lives on.

An attacker who reads that knows your vendor, your model, your firmware, which configuration software wrote your program, and where the master copy sits. That is the entire pre-attack research phase, published on request.

The fix is usually a field in the project properties. Use a plain site name.

What we are not saying

We have no visibility into the Minnesota incidents and no indicators from them. None of the controllers we measured are affected utilities — no overlap, no shared infrastructure, nothing linking our exposure set to the attacks. We are not claiming otherwise and we are not claiming credit for a finding CISA published before we wrote this.

What we are saying is narrower: they named the mechanism, the mechanism has a visible fingerprint, and the fingerprint points at installers rather than operators. If you are a small utility that read the alert and wondered where to start, start in the cabinet and then start on the phone to whoever built your system.

Confidence capped at 95%. CISA alert details, vendor scope and Censys exposure figures are from the published alert and contemporaneous reporting. Our measurements are passive third-party scan data read on 31 July, indicative rather than exact, and point-in-time — we sent no traffic to any host. The clustering is anonymised on purpose and will stay that way.

---

How do AI models see YOUR brand?

AIPM has audited 250+ domains. 15 seconds. Free while still in beta.

Audit your site now → aipmsec.com