CoreRecon Threat Intelligence • Water & Wastewater Utilities • June 2026

Texas Water Utilities:
Foreign Target

In January 2024, CyberArmyofRussia — a Sandworm-linked hacktivist group — compromised HMI systems at four Texas Panhandle water utilities via exposed VNC with no authentication. In Muleshoe, a tank overflowed before operators noticed. AWIA Section 2013 now requires SCADA cybersecurity in every Risk & Resilience Assessment. Most Texas water systems still aren't in compliance.

CyberArmyofRussia hit Muleshoe, Hale Center, Abernathy, and Lockney — tank overflow in Muleshoe before manual intervention
Unitronics Vision PLCs found on Shodan with factory-default credentials — same hardware across all 4 sites (CISA AA24-057A)
North TX Municipal Water District: Daixin Team ransomware — 1.1M customer records exfiltrated, Nov 2023
AWIA Section 2013 RRA now mandates cybersecurity of SCADA, HMI, and control systems as a named requirement
6 confirmed threat actors targeting water sector OT: Sandworm, CyberAv3ngers, Daixin, Rhysida, Black Basta, Volt Typhoon

Download the Full Threat Brief — Free

June 2026 CoreRecon Intelligence Report V34 48 Verified Sources AWIA + EPA RY2 + TCEQ + CISA CPGs

What This Brief Covers

TX Water Utilities
Cyber Threat Brief

Full intelligence report on the attack surface facing Texas water and wastewater systems — from the CyberArmyofRussia Muleshoe attack and Daixin Team breach at North TX MWD, to AWIA Section 2013 compliance gaps, Unitronics PLC exposure, and the regulatory stack that puts water districts at risk. 48 verified sources. No marketing fluff. Documented incidents, applicable regulations, and actionable controls built for water district managers, operators, and public works directors.

48 Verified Sources Including:

CISA Emergency Advisory AA24-057A — CyberArmyofRussia / Sandworm-linked water utility compromise (Jan 2024)
CISA ICS Advisory ICSA-23-320-05 — Unitronics Vision series CVSS 10.0 auth bypass affecting TX water utilities
AWIA Section 2013 — full RRA cybersecurity requirements for community water systems >3,300 served
EPA Risk & Resilience Assessment guidance — SCADA cybersecurity mandatory scope and audit framework
CISA Cross-Sector CPGs — 17 water-sector applicable goals with implementation guidance
6 named threat actors targeting water sector OT: Sandworm, CyberAv3ngers (IRGC), Daixin Team, Rhysida, Black Basta, Volt Typhoon
3 confirmed incidents: Muleshoe TX (2024), North TX Municipal Water District (2023), Aliquippa PA (2023)
Oldsmar FL (2021): TeamViewer sodium hydroxide manipulation — direct remote access attack vector
TX SB 820, TDPSA, TCEQ Chapter 290 — state-specific compliance obligations
8 water-utility-specific controls with 30/60/90 implementation roadmap

Access the Full Brief

We email it once. No newsletter. No spam. PDF delivered to your inbox.

First Name *

Last Name *

Work Email *

Water District / Utility Name *

Your Role

Endpoint Count Range

Work email required. Free email providers (Gmail, Yahoo, Outlook, etc.) are not accepted. By submitting, you consent to CoreRecon processing your information per our privacy policy.

Submission failed — please try again or email john@corerecon.com

Brief Sent.

Check your inbox — the PDF is on its way. If it lands in spam, drag it to your inbox so you find it later.

Questions before then? Call (800) 955-2596 — live TX SOC, not a call center.

Book Free Posture Assessment →

SDVOSB Certified • TX-Based SOC • No offshore data routing
Questions? (800) 955-2596

Texas Water Utilities:Foreign Target

TX Water UtilitiesCyber Threat Brief

48 Verified Sources Including:

Access the Full Brief

Brief Sent.

Texas Water Utilities:
Foreign Target

TX Water Utilities
Cyber Threat Brief