Per joint advisory AA23-335A, attackers authenticated to internet-connected Unitronics Vision PLCs and HMIs that had default or no passwords, compromising at least 75 US devices, including at least 34 in water and wastewater. The fixes are old ones: remove internet exposure, change credentials, and add layers.
What the advisory says happened
AA23-335A was published on 1 December 2023 and last revised on 18 December 2024, by CISA, FBI, NSA, EPA and partners. It describes activity by actors affiliated with Iran's IRGC using the persona CyberAv3ngers. Between November 2023 and January 2024, they compromised at least 75 devices in the US, at least 34 of them in the water and wastewater sector.
The same PLCs are also used in energy, food and beverage manufacturing, transportation and healthcare, and rebranded versions can appear under other makers' names.
How access was gained
Actors authenticated to internet-connected devices over the default TCP port 20256. The devices had the default password or no password. No exploit was needed.
After access, the actors replaced the ladder logic with their own, which had no inputs or outputs, renamed devices, disabled upload and download, changed the port, and showed a defacement message on the HMI that hid normal data. The advisory warns that deeper access could allow more serious cyber-physical effects.
What the advisory recommends
Immediately:
- Update engineering software and device firmware to the versions the advisory names.
- Replace default passwords with strong, unique ones.
- Disconnect PLCs from the public internet, or disable remote programming and require strong passwords.
- Change default ports and device names, and put devices behind firewalls.
Next:
- Turn on multifactor authentication for OT access.
- Use VPNs, gateways or proxies for required remote access.
- Segment networks, for example using the Purdue model.
- Keep asset inventories and periodically check for internet-exposed devices.
- Monitor for unusual logins and configuration changes.
- Keep tested backups of PLC logic and configuration.
For manufacturers: ship without default passwords, avoid exposing admin interfaces to the internet, and support multifactor authentication.
Lessons for any operator
Two of the failures here are cheap to fix. Know what is exposed, and change what ships with a default. The backup advice matters just as much: if someone overwrites your logic, a tested copy turns a crisis into a restore job.
The advisory's manufacturer section is also a reminder for buyers. Ask vendors whether products ship with unique credentials and whether admin interfaces can be kept off the internet. Our piece on the American Water incident covers a related utility case.
Quick check
Did attackers use a software vulnerability?
The advisory describes access using default or missing passwords on internet-connected devices, mapped to brute force and default account techniques, not a new exploit.
Is this only a water sector problem?
No. The advisory says the same PLCs are used in several sectors.
Safeguard can help you keep a current software inventory and scan dependencies in the applications around your controls, using asset discovery and SBOM scanning. It is not a PLC monitoring product.
Sources
Last reviewed: 19 October 2026.
