Author: matthewframe

Defending Against S7 Series PLCs

Posted on by matthewframe

Defending Against an Active Threat to Siemens S7 Series PLCs

Overview

The National Security Agency (NSA) has issued a cybersecurity advisory to inform owners and operators of Siemens S7-series Programmable Logic Controllers (PLCs) of an active cyber threat to these industrial control systems (ICSs).

Recommended Actions

EPA recommends water and wastewater systems review the tactics, techniques, and procedures (TTPs) in the advisory and the potential operational impacts to learn more about this threat, and apply the recommended mitigation actions and preventative hardening actions to minimize the likelihood of an attack.

For the full CISA report visit Defending Against an Active Threat to Siemans S7 Series PLCs.

Remember- If you see something, say something:

Report suspicious activity and threats of violence, including online threats as appropriate to local law enforcement, FBI – Richmond Field Office, and the VSP Fusion Center. The VSP Fusion Center will take appropriate action and investigate reports of concern with appropriate state and federal partners. The EPA Incident Action Checklist for Cybersecurity also includes resources for preparation and recovery. 

Maintain vigilance to protect critical infrastructure.  Please ensure your workforce is aware of the potential threats and that they know to report any and all suspicious activity to the VSP Fusion Center.  Thank you for taking immediate action to harden assets and protect people and critical infrastructure.

Cybersecurity & Infrastructure Security Agency (CISA)
Incident Reporting Webpage
Email: report@cisa.gov
Phone: 1-844-Say-CISA (1-844-729-2472)
Virginia Fusion Center
Virginia Fusion Center: Incident Reporting Webpage
Phone: 877-4VA-TIPS (877-482-8477)

View the VDH-Office of Drinking Water Website for Waterworks Cybersecurity for more resources.

Hurricane Season Information

Posted on by matthewframe

Hurricane season runs from June 1 through November 30, and Virginia’s water utilities play a critical role in community safety and resilience. Even storms that don’t make landfall in Virginia can bring heavy rainfall, flooding, power outages, and supply chain disruptions that affect water operations.

The Commonwealth is entering hurricane season, which runs from June 1 through November 30. Now is the time to prepare and review your emergency plans to ensure your utility is ready for severe weather impacts. Review the Hurricane Checklist to help stay prepared. Below is the link to the EPA Hurricane Incident Action Checklist: Water Sector Utility Incident Action Checklist – Hurricanes.

More information on hurricane season and emergency preparedness can be found here.

Virginia Drought Conditions Alert

Posted on by matthewframe

Virginia is currently experiencing severe drought conditions, with much of the Commonwealth under a drought watch or warning. Now is the time for utilities to ensure they are prepared should conditions continue to worsen by reviewing response plans, monitoring water supply levels, and coordinating with local partners. Utilities are encouraged to review the EPA Drought Checklist to assess preparedness and continue monitoring DEQ’s Drought webpage for the latest updates and conditions.

Please also find more information on the ODW Drought Monitoring Program – Drinking Water Webpage.

Provided is a recent drought report map.  To see the current drought monitoring maps and report click the link here.

 

ODW Newsletter

Posted on by matthewframe

The August 2026 ODW Newsletter covers several important topics highlighted below:

  • Defend Against Active Threat to Siemans S7 Series PLCs
  • Technical and Regulatory Updates
  • US EPA: Checklist for Laboratories providing Analytical Support for Water Contamination Incidents
  • 2026 Drought Update
  • Security & Resilience
  • Hurricane Season Update
  • Upcoming Training and Webinars

More information on all these topics can be found in the August 2026 Newsletter.

A link to previous ODW Newsletters and bulletins can be found on the ODW Newsletters page.

Nationwide Verizon Outage

Posted on by matthewframe

CIR: CIR 7.1.A – Cellular infrastructure outage, or imminent outage, impacting, or with the potential to impact, public safety, public health, and/or critical infrastructure

Incident Date/Time: 01-14-2026 12:27

Information Authority: SWIC

Localities Affected: United States (Country-Wide)

Incident Location: USA

Incident Summary: Verizon is experiencing an intermittent outage, impacting major cities nationwide. Approximately 177,000 users are affected, with many devices displaying SOS Mode. Unknown cause of the outage with unknown restoration time. Other US based cell carriers (T-Mobile, AT&T, and US cellular) are starting to service impacts to their customers.

Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure

Posted on by matthewframe

The FBI, CISA, NSA assess pro-Russia hacktivist groups are conducting less sophisticated, lower-impact attacks against critical infrastructure entities, compared to advanced persistent threat (APT) groups. These attacks use minimally secured, internet-facing virtual network computing (VNC) connections to infiltrate (or gain access to) OT control devices within critical infrastructure systems. Pro-Russia hacktivist groups—Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated groups—are capitalizing on the widespread prevalence of accessible VNC devices to execute attacks against critical infrastructure entities, resulting in varying degrees of impact, including physical damage. Targeted sectors include Water and Wastewater Systems, Food and Agriculture, and Energy.

More information on this alert can be found here.

BRICKSTORM Backdoor CISA Alert

Posted on by matthewframe

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and Canadian Centre for Cyber Security (Cyber Centre) assess People’s Republic of China (PRC) state-sponsored cyber actors are using BRICKSTORM malware for long-term persistence on victim systems. CISA, NSA, and Cyber Centre are releasing this Malware Analysis Report to share indicators of compromise (IOCs) and detection signatures based off analysis of eight BRICKSTORM samples. CISA, NSA, and Cyber Centre urge organizations to use the IOCs and detection signatures to identify BRICKSTORM malware samples.

More information on the alert can be found on the CISA website here.

Winter Weather Preparedness

Posted on by matthewframe

winter storm warning vs winter storm watch

Winter storms can bring a combination of freezing temperatures, snow, ice, and extended power outages that pose significant challenges to water systems. Even brief periods of extreme cold can impact treatment processes, freeze exposed equipment, limit staffing, and disrupt transportation and chemical deliveries. Preparing now helps ensure continued safe operation and reliable service throughout the winter season.

Key preparedness reminders for waterworks:

  • Inspect and protect vulnerable equipment such as exposed pipes, meters, chemical feed lines, and outdoor instrumentation.
  • Verify backup power systems and ensure fuel, generators, and transfer switches are ready for potential outages.
  • Confirm employee call-down lists and ensure staff understand inclement weather reporting procedures.
  • Review chemical inventory and resupply plans in case road conditions delay deliveries.
  • Coordinate with local emergency management and monitor updates from the National Weather Service.

Prepare for customer impacts such as frozen service lines and potential low-pressure events

Being proactive with winter storm readiness supports operational resilience, protects infrastructure, and ensures the continued delivery of safe drinking water to Virginia communities. More information on winter weather and emergency preparedness can be found here.

Lead and Copper Rule Revisions Guidance

Posted on by matthewframe

EPA has introduced the Lead and Copper Rule Revisions (LCRR) and Lead and Copper Rule Improvements (LCRI). ODW staff have compiled resources for utilities to ensure they properly implement the rule changes and additions.

Information can be found here