Ransomware poses a threat to water and wastewater treatment facilities, according to a warning issued by federal agencies.
In recent years, the water and wastewater treatment industry in the United States has become a prime target for cyber-attacks. Last week, the Senate Committee on Environment and Public Works held field hearings in Dover, Delaware, and Beckley, West Virginia, to address the growing concern.
According to a joint advisory from the FBI, CISA, EPA, and NSA, ransomware attacks against water and wastewater facilities have increased significantly. In August, a California wastewater facility was attacked using the Ghost ransomware variant, while a July attack in Maine targeted the ZuCaNo ransomware.
These attacks are not limited to large facilities. In September, at least two farm co-ops in Iowa and Minnesota were targeted. The threat actors often target systems with outdated operating systems or unpatched software, many of which are underfunded or have not maintained adequate security controls.
The battle against critical infrastructure attacks is emphasized as beginning with proactive measures before an incident, according to Eric Goldstein, executive assistant director for cybersecurity at CISA. Cybersecurity threats to the operational technology landscape should now be part of the list of risks that designers and operators of water and wastewater treatment facilities address, according to Carmen Garibi.
The criticality of water and wastewater infrastructure and recent intrusions impacting the sector reflect the need for continued focus and investment. Beyond the threat of ransomware, there is also a risk from insiders, either due to failing to safeguard their credentials or acting in a malicious manner.
In the California attack, the Ghost ransomware variant was in the system for about a month before three SCADA servers displayed a ransomware message. Threat actors are targeting systems with often outdated operating systems or unpatched software, many of which are underfunded or have not maintained adequate security controls.
Smaller critical infrastructure sites have ongoing problems with security operations, according to Claroty. The affected water and wastewater functional agencies in the USA impacted by ransomware attacks over the past two years include numerous municipal water utilities and wastewater treatment facilities; specific names are not publicly disclosed, but the FBI and CISA recently warned about ransomware threats to agricultural and food sector entities nationwide.
A former employee was charged with trying to hack into the Post Rock Rural Water District in Kansas. The attacks are being carried out by both known and unknown actors, using spear phishing attacks to gain network access to IT and OT systems.
Federal authorities have issued a warning about an increase in ransomware attacks targeting local water and wastewater facilities in the U.S. The FBI and CISA recently put out a warning about potential ransomware attacks against agricultural and food sites. Eric Goldstein stated that recent ransomware incidents and ongoing threats demonstrate the need for cybersecurity to be a top priority for all critical infrastructure owners and operators.
In response to these threats, the water and wastewater treatment industry has taken steps to address concerns, as demonstrated by the Senate Committee hearings. The industry must continue to prioritize cybersecurity to protect our critical infrastructure and ensure the safety and security of our water and wastewater systems.
