{"description": "ICS techniques used by 2026 U.S. Water Utilities Attacks, ATT&CK campaign C0066 (v1.0)", "name": "2026 U.S. Water Utilities Attacks (C0066)", "domain": "ics-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T0892", "comment": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary remotely accessed internet-facing devices (e.g., MicroLogix 1100 and 1400 controllers, etc.) and changed passwords resulting in loss of monitoring and control for the affected utilities.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0813", "comment": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary denied operators the ability to control their systems by shutting down and disabling computerized water plant controls via malware over a wireless connection.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1694", "showSubtechniques": true}, {"techniqueID": "T1694.001", "comment": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary logged in to internet-exposed PLCs using default credentials.(Citation: Tenable Minnesota Water Utilities)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T0883", "comment": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary located internet-exposed PLCs (e.g., Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs, etc.) at water and wastewater utilities, including cellular-connected water towers and sewer lift stations, and logged in to them directly.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: FBI Water and Wastewater)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0826", "comment": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary temporarily shut down the well and water treatment plant, causing loss of cellular connectivity across multiple sites interrupting the service the plant provides leading operators to revert to manual operations.(Citation: Tenable Minnesota Water Utilities)(Citation: Dragos Water Under Attack)\n\nDuring the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary caused loss of water pressure and flooding at affected water and wastewater utilities.(Citation: FBI Water and Wastewater)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0827", "comment": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary changed passwords on internet-facing MicroLogix controllers, locking out operators, and causing water and wastewater utilities to lose control of their equipment (e.g., controllers, water towers, lift stations).(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0829", "comment": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary changed passwords on internet-facing MicroLogix controllers, causing the affected utilities to lose monitoring of their equipment (e.g., water tower, lift station, etc.).(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0836", "comment": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary changed the IP addresses of internet-facing MicroLogix controllers, altering their network configuration settings outside normal operations.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: Dragos Water Under Attack)(Citation: FBI Water and Wastewater)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T0889", "comment": "During the [2026 U.S. Water Utilities Attacks](https://attack.mitre.org/campaigns/C0066), the adversary altered the control logic (e.g., project files) of internet-exposed PLCs, producing ladder logic discrepancies, changing how the affected controller interacted with its process, after gaining access through default credentials.(Citation: Tenable Minnesota Water Utilities)(Citation: Forescout Water Systems Attack)(Citation: FBI Water and Wastewater)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by 2026 U.S. Water Utilities Attacks", "color": "#66b1ff"}]}