How Zeek and Suricata Can Detect the Water-System Attacks Seen in July 2026
By the Critical Path Security Detection Engineering Team
In July 2026, cyberattacks disrupted water systems across several U.S. states, including more than 30 community water systems in Minnesota. Additional incidents were reported in Canada.
Some related activity has been associated with Iranian-linked groups known to target industrial control systems. However, the broader wave of attacks remains formally unattributed.
What stood out was not the sophistication of the attacks. It was how little sophistication was required.
The attackers did not need a new type of malware or an undiscovered vulnerability. In many cases, internet-accessible industrial controllers, poorly secured cellular modems, weak credentials and legitimate engineering software were enough to reach systems responsible for controlling pumps, valves, pressure and water treatment processes.
Our detection engineering team reviewed the available technical reporting against our existing Zeek and Suricata detection stack. Most of the observed activity was already covered. We also identified two areas where additional detection was needed and built that coverage.
What Happened
The attackers targeted industrial devices made by vendors including Rockwell Automation, Schneider Electric and Siemens. Earlier attacks attributed to the group known as CyberAv3ngers also targeted Unitronics controllers and human-machine interfaces.
These devices communicate using standard industrial protocols such as EtherNet/IP, CIP, S7comm and Modbus. Some were directly exposed to the internet. Others were reachable through cellular modems or third-party remote-access connections.
Once connected, attackers could use legitimate engineering tools to interact with the controllers. Reported activity included downloading project files, changing controller settings, modifying ladder logic, changing passwords and network addresses, and altering information displayed through monitoring systems.
In at least one reported case, alarms were disabled while the system continued to present operators with a normal-looking view. A compromised cellular modem was also configured to run Dropbear, a lightweight SSH service commonly found on embedded devices. This gave the attacker a persistent remote-access path into the environment.
The physical consequences included loss of water pressure, flooding, communications outages, boil-water notices and extended periods of manual operation.
The devices involved may have been small, but their responsibilities were not. A single controller operating a pump or valve can directly affect public safety.
What Our Existing Detections Could See
Our OT detection library focuses on actions rather than attacker infrastructure.
IP addresses, server names and other indicators can change quickly. The underlying actions are more consistent. An attacker may use a new address tomorrow, but they still need to send commands, change controller logic, stop a process or modify a setpoint.
Our existing coverage could identify activity such as:
- Connections from external systems to common industrial-control ports
- Industrial devices communicating directly with the internet
- Rockwell controller programming and project changes over EtherNet/IP and CIP
- Siemens controller stop commands, operating-mode changes and program transfers
- Modbus commands that change coils, registers and process values
- DNP3 restart, stop and disable operations
- Control commands sent from a system that is not an approved engineering workstation or master device
This means the detection logic is not limited to a particular attacker group. It can also identify copycats or unrelated attackers using the same techniques.
Two new detections we added: Our review identified two specific behaviors that required additional coverage.
Embedded SSH and Dropbear Remote Access
The reporting described Dropbear SSH running on a compromised cellular modem. We already collected SSH connection information and fingerprints through Zeek, but we were not generating a dedicated alert for this type of embedded remote-access service.
We added a Zeek detection that flags Dropbear and similar embedded SSH banners when they appear on a monitored network.
We also added a separate alert for successful SSH connections originating outside the trusted network and terminating on a system inside the OT environment.
Not every Dropbear installation is malicious. However, an unexpected embedded SSH service on a modem, controller or field device should be investigated, particularly when it is accessible from outside the organization.
Schneider Modicon UMAS Activity
The attacks also involved Schneider Electric Modicon M340 controllers.
These devices can be programmed using EcoStruxure Control Expert. The engineering software communicates with the controller using a proprietary protocol called UMAS, which operates inside Modbus traffic.
UMAS can be used to upload and download projects, change controller operating modes, manage passwords and modify logic.
Previously, this traffic appeared only as an uncommon or unknown Modbus function. We added a dedicated Zeek detection that identifies UMAS engineering activity and checks whether it originated from an approved engineering workstation.
UMAS traffic from an unexpected device is a strong indicator that someone may be attempting to program or control the PLC without authorization.
The Most Valuable Detection Signal
One of the strongest OT detection methods is also one of the simplest:
Identify any system sending control or programming commands that is not an approved master or engineering workstation.
Industrial protocols often do not authenticate the sender in the way modern enterprise applications do. A controller may accept a properly formatted command without knowing whether it came from the legitimate engineering workstation or an attacker’s laptop.
That makes an accurate inventory essential.
Organizations should know which systems are authorized to communicate with each type of controller. Once those approved systems are defined, Zeek and Suricata can identify commands coming from anywhere else.
This approach can detect unauthorized activity even when the attacker uses legitimate software and valid protocol commands.
What Network Detection Cannot Solve
Detection can tell you that someone reached the process-control layer. It cannot correct the weakness that allowed them to get there.
The underlying security failures described in the reporting were familiar:
- Controllers directly accessible from the internet
- Cellular modems without adequate protection
- Default, weak or reused credentials
- Shared configurations used across multiple customer environments
- Remote access that bypassed hardened security gateways
- Limited separation between business and operational networks
Addressing those issues requires architectural changes.
Controllers should not be directly exposed to the internet. Remote access should pass through a managed gateway protected by multifactor authentication. Default and shared credentials should be replaced. Engineering project files should be compared with known-good versions. Business and OT networks should be segmented. Utilities should also maintain and test procedures for safely operating systems manually.
Zeek and Suricata provide the tripwire. They do not replace the need to close the door.
The Lesson for Water Utilities
These attacks did not require advanced malware. Detecting them does not require chasing every new attacker-controlled IP address.
Defenders can identify this activity by watching for:
- External access to industrial-control ports
- Unexpected internet communication from controllers
- Programming, write and control operations inside OT protocols
- Commands originating from unauthorized systems
- Embedded remote-access services such as Dropbear
- Engineering activity involving protocols such as UMAS
Our review confirmed that the existing Léargas and Critical Path Security detection stack covered most of the reported behavior. We added dedicated detections for embedded SSH remote access and Schneider Modicon UMAS activity.
The larger lesson is that even a small, lightly protected controller can have a direct effect on public health and safety. OT monitoring must therefore focus not only on whether a device is online, but also on who is issuing commands, what those commands are designed to do and whether that activity is expected.
Organizations that need help identifying authorized OT systems, reviewing controller exposure or tuning Zeek and Suricata detections can contact their Critical Path Security team.