296K IoT Botnet Scans 100+ Water Systems for Exposed HMIs and RTUs

The campaign leveraged compromised routers, cameras, and industrial gateways to map public-facing OT assets. Traffic analysis showed repeated probes for default credentials on web interfaces tied to water treatment controls, consistent with patterns seen in prior Mirai variants adapted for infrastructure scanning. Procurement records and job postings from utilities reveal persistent gaps in network segmentation between IT and OT environments that enable such reach. Contract awards for water-sector cybersecurity remain disproportionately low relative to documented exposure; CISA incident reports from 2024-2025 already flagged identical device classes in successful intrusions. The current botnet's command infrastructure overlaps with domains previously used in campaigns against energy and transport operators, indicating reuse rather than novel tooling. Independent verification of targeting came from passive DNS and honeynet telemetry rather than utility disclosures. Official statements continue to classify incidents as generic scanning while downplaying persistent access attempts. Next phase indicators point to credential-stuffing escalation against newly indexed devices within the next 60 days.