Water and Wastewater Sector
Advisory Alert

The Michigan Cyber Command Center (MC3) is responsible for the coordination of combined efforts of cyber emergency response during critical cyber incidents in Michigan. Emphasis is placed upon prevention, response, and recovery from cyber incidents.

MC3 works collaboratively with the Michigan Department of Environment, Great Lakes, and Energy (EGLE), the Cybersecurity and Infrastructure Agency (CISA), Federal Bureau of Investigation (FBI), and the U.S. Environmental Protection Agency (USEPA) to provide an overview of the cyber threats facing the water sector (drinking water, wastewater, industrial storm water) and additional resources that you can use to learn more about cybersecurity best practices and reducing the risk of cybersecurity threats. EGLE recommends that water sector utilities contact the MC3 to initiate criminal investigative assistance and response as soon as a critical cyber incident is identified.

Michigan Cyber Command Center
MC3@Michigan.gov
877-MI-Cyber (877-642-9237)

Michigan Cyber Command Center Cyber Situational Awareness Message

The Michigan State Police, Michigan Cyber Command Center (MC3) issued a Cyber Situational Awareness Message late last week. The information linked in the message was previously sent out in March as well. A recent cyber-attack was directed at Rockwell/Allen Bradley PLC devices and the MC3 recommended actions are provided in the message below. 

Related links/resources to the current cyber incident for your awareness:

• Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions
• CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
• Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
• Censys warns systemic exposure of Rockwell PLCs enable Iran-linked targeting of critical infrastructure OT networks
• 30 Minnesota water systems targeted in cyberattack | FOX 9 Minneapolis-St. Paul

We are also aware of recent attempted and confirmed cyberattacks to municipal water/wastewater facilities in communities across the state in the last couple months. We acknowledge that critical infrastructure plays an important role in our communities, and protecting this infrastructure is of the utmost importance regardless of the cause.

If you are or become aware of any victims of this or any other cyberattack, please notify the MC3 at MC3@michigan.gov and include contact information for the victim entity. Specific to this attack, the MC3 is interested in the following details, if available: available logs (network/firewall) for indicators of compromise (IOCs) and check available logs for suspicious traffic on the ports associated with OT devices, including 44818, 2222, 102, and 502, especially traffic originating from foreign hosting providers.

Register for a Cybersecurity Assessment

Resources

• Understand and Evaluate your Exposure to the Public Internet: CISA Cyber Hygiene Scanning service provides weekly vulnerability reports of your public facing network assets. This gives you the information that an adversary would see when scanning the internet for targets.  https://www.cisa.gov/cyber-hygiene-services
• Cybersecurity Training for the Water Sector – Upcoming and Recorded trainings specific to the water sector. Check out the 30 minute YouTube video posted in the middle of this page: https://www.epa.gov/waterresilience/cybersecurity-training
• Cybersecurity Assessments – if you would like to have an in-person, no-cost confidential cybersecurity assessment of your facility conducted by CISA and MC3, contact your EGLE district engineer.
• Top Cyber Actions for Securing Water Systems
• Cybersecurity for the Water Sector (Michigan.gov)