Aliquippa Pennsylvania water authority CyberAv3ngers Unitronics PLC compromise

On Saturday, November 25, 2023, operators at the Municipal Water Authority of Aliquippa, Pennsylvania, noticed that the HMI on a Unitronics Vision Series programmable logic controller at one of the authority's booster stations had been defaced with anti-Israel imagery and the message "You have been hacked. Down with Israel. Every equipment 'made in Israel' is CyberAv3ngers legal target." The compromised station regulated pressure for Raccoon and Potter Townships. Operators reverted to manual control within minutes; no impact on drinking-water quality or supply was reported. The Unitronics device was internet-exposed on TCP/20256, the default port of the Unitronics PCOM management protocol, with the factory-default password "1111" still in place. CISA, FBI, NSA, EPA, and Israel's INCD jointly published advisory AA23-335A on December 1, 2023 describing the attack and the broader CyberAv3ngers campaign against Unitronics devices at US and Israeli water utilities. CISA assessed CyberAv3ngers as affiliated with the IRGC Cyber Electronic Command. The incident triggered the Water Cybersecurity Enhancement Act discussion in Congress and is the proximate cause of the EPA-CISA water-sector Unitronics-mitigation campaign of December 2023 to early 2024.

Localized booster-station OT compromise with manual fallback; no water-supply or quality impact to customers; sector-wide impact catalyzed federal and state water-utility cybersecurity policy responses; precursor to the 2026 CISA AA26-097A Iran multi-sector PLC campaign.