One alert, three threats: how local agencies should have read the June 2025 Iran warning

The week

On the night of June 21, 2025, U.S. forces struck three Iranian nuclear sites: Fordow, Natanz and Isfahan. The Pentagon called the operation Midnight Hammer. It came after more than a week of Israeli attacks on Iran that had begun on June 13. It changed the risk picture for American organizations almost overnight, including organizations that had nothing to do with foreign policy: city halls, county offices, water utilities and 911 centers.

The next day, June 22, the Department of Homeland Security issued a National Terrorism Advisory System bulletin. The NTAS, as it is known, is the federal government’s public channel for telling Americans when the threat of attack has risen. This bulletin described a “heightened threat environment.” On the cyber front it said two things. First, low-level cyberattacks on U.S. networks by pro-Iranian hacktivists were likely. Hacktivists are activist hacking groups, often loosely organized, who attack to make a political point and get attention rather than to make money. Second, cyber actors affiliated with Iran’s government might also conduct attacks. Those are a different breed: better resourced, more patient and working toward state goals.

The bulletin was broader than its cyber lines. It warned that violent extremists in the United States might mobilize on their own in response to the conflict. It said a religious ruling by Iranian leadership calling for retaliation could raise that risk. It noted that several recent attacks in the homeland had been driven by antisemitic or anti-Israel motives. It also recalled Iran’s long-standing intent to target U.S. officials it holds responsible for the January 2020 killing of an Iranian military commander. The bulletin was set to expire on September 22, 2025.

On cyber, one more sentence deserved a local official’s attention. Both hacktivists and government-affiliated actors, the bulletin said, routinely target poorly secured U.S. networks and internet-connected devices. That sentence picks victims by their weaknesses rather than their importance.

Iran answered the U.S. strikes on June 23 with a missile attack on Al Udeid Air Base in Qatar, which hosts U.S. forces. That evening, President Trump announced a ceasefire between Israel and Iran, and it took hold on June 24. But the cyber warnings did not stop with the shooting. On June 30, four federal bodies — CISA (the Cybersecurity and Infrastructure Security Agency, the federal government’s lead civilian cyber defense agency), the FBI, the Defense Department’s Cyber Crime Center and the NSA — published a joint fact sheet. It warned that Iranian state-sponsored or affiliated actors might target vulnerable U.S. networks and devices.

The fact sheet was more specific than the bulletin. It said defense industrial base companies, especially those with holdings in or ties to Israeli research and defense firms, were at increased risk. It said hacktivists and Iranian government-affiliated actors often choose targets of opportunity: known, unpatched vulnerabilities, and accounts and devices still using default or common passwords. It expected hacktivist denial-of-service campaigns against U.S. and Israeli websites. It also warned that Iranian-affiliated actors had worked directly with ransomware affiliates, both to encrypt victims’ systems and to steal and leak data. On its web page, CISA added that it had not seen signs of a coordinated Iranian campaign in the United States at that point.

The document also looked back. Between November 2023 and January 2024, it recalled, actors affiliated with Iran’s Islamic Revolutionary Guard Corps had compromised Israeli-made programmable logic controllers and operator screens around the world. U.S. victims numbered in the dozens, in water and wastewater, energy, food and beverage manufacturing, and health care. The recommended steps were concrete. Find OT assets and disconnect them from the public internet. Replace default and weak passwords. Require phishing-resistant MFA to reach OT networks. Patch internet-facing systems. Watch remote access logs and configuration changes. Keep backups and recovery plans ready.

The fact sheet singled out operators of operational technology and urged them to take specific defensive steps. Operational technology, or OT, is the computing equipment that runs physical processes rather than paperwork: the controllers that open valves at a water plant, run pumps at a lift station or manage traffic signals. When ordinary office IT fails, email stops. When OT fails or is tampered with, water pressure drops or chemical levels change.

For a mayor, a county administrator or a utility general manager, the week delivered a familiar kind of message: be on alert. What “being on alert” should actually mean for a local agency with a modest budget and a small technical team was much less clear.

On the Monday morning after a heightened threat bulletin lands, the routine in a typical county building goes like this. The IT director forwards the federal notice to department heads. Someone sends an all-staff email reminding people not to click suspicious links. The security vendor is asked to “increase monitoring.” Everyone feels that something responsible has happened.

That general response is weaker than it looks. For state and local agencies, water and wastewater utilities and public safety organizations, the June 2025 warning covered three different threats, carried out by different actors against different targets and stopped by different controls. We separate them into nuisance attacks by hacktivists, opportunistic intrusions into exposed operational technology, and targeted operations by state-affiliated actors. Sorting them tells an agency who owns each response and whether it is measured in hours, days or years.

The sorting also explains why the same week looked different from different desks. A communications director saw a flood of claims on social media. A water superintendent saw a federal list of controller settings. A state CISO saw an adversary whose most capable units would not show themselves at all. Each was looking at a real part of the same warning, and each needed a different plan. The sections below take the reasoning first, then each threat in turn, then the one-page plan that ties them together and the checks a leader can run before the next bulletin.

Why one warning hides three threats

A federal bulletin has to speak to the whole country at once. It is written for a hospital in Houston, a bank in Charlotte and a sewer district in rural Ohio. So it uses one phrase — “heightened threat environment” — to cover a wide range of possible attackers and possible harms.

For an individual agency, that single phrase is not very useful on its own. A weather service warning of “severe weather” across a whole region has the same problem. A coastal town needs to think about storm surge, a hill town about mudslides and a farm about hail. Each needs to act, but the actions are completely different, and the people who take them are different too.

The same is true of cyber threats after a geopolitical event. The three categories differ along four lines that matter to a leader:

• Who the attacker is. A loose group of activists looking for headlines behaves very differently from a military-linked unit with years of patience.
• What they are after. Embarrassment and attention, easy access to anything that is left open, or deliberate access to a chosen organization.
• Who inside the agency should respond. Communications staff, operations and public works staff, or the chief information security officer (CISO), the executive responsible for protecting the organization’s systems and data.
• How fast the fix can happen. Hours, days or budget cycles.

Once a leadership team sees the warning this way, the vague instruction to “be vigilant” turns into three concrete assignments with names and deadlines attached.

What a national bulletin can and cannot do

The NTAS bulletin is written for the public, not for system administrators. Its job is to raise awareness and point readers to the right agencies. It does not list technical clues, name devices or set deadlines. The technical detail arrives later, through products such as the June 30 fact sheet, and often through different channels: CISA’s website, the MS-ISAC, sector groups such as WaterISAC, and state fusion centers.

That gap in time and channel shapes the local response. The bulletin reaches elected officials and department heads first, often through the news. The technical guidance reaches whoever subscribes to the right feeds, which in a small town may be one contractor. An agency that waits for technical guidance before acting loses the first week. One that acts on the bulletin alone tends to do generic things. The three-way split lets an agency start the right work on day one, then refine it when the detailed guidance lands.

Why the categories stay separate

A fair objection is that the three categories overlap. The Iranian actors behind the 2023 controller campaign operated under a hacktivist-style persona, CyberAv3ngers, and announced their claims on Telegram. State actors borrow the noise of hacktivism to hide behind, and hacktivist claims sometimes rest on real state-linked intrusions.

The overlap is real, but it lies in the attacker’s identity rather than in the defense. The controls that stop a website flood do not stop a controller takeover. Neither stops a patient intruder holding valid administrator credentials. The split works because it follows what the defender has to do, which is the part an agency controls. Attribution can stay uncertain for months; the defensive work cannot wait for it.

Matching the categories to the organization

The weight of each category varies by type of organization. A general-purpose city government with a website, a records system and a small police department faces mostly the first and third. A water or wastewater utility, whether a city department or an independent authority, faces all three, with the second carrying physical consequences. A 911 center or emergency communications district faces the first through its call volume and the third through its links to state and federal networks. A county that runs a hospital, an airport or a port adds that sector’s own rules on top.

Regulatory duties differ as well. Community water systems serving more than 3,300 people must, under Section 1433 of the Safe Drinking Water Act, complete a risk and resilience assessment and an emergency response plan. They certify both to the EPA and review them every five years. Those documents should already describe the second category. Agencies that handle criminal justice information must meet the FBI’s CJIS Security Policy, which shapes how they authenticate users and keep audit records. A general city office may have no sector-specific cyber rule at all, beyond state breach notification laws and any conditions attached to grants.

Nuisance attacks: hours, and owned by communications

Pro-Iranian hacktivist groups have a long record of denial-of-service attacks on public websites, defacements and claims of data theft, some exaggerated or false. Within hours of the strikes, groups claimed denial-of-service attacks on U.S. targets, a pattern threat researchers tracked through the following days.

A few terms are worth unpacking. A denial-of-service attack floods a website with so much junk traffic that real visitors cannot get through. Nothing is stolen and nothing inside is damaged, but the site is effectively closed for as long as the flood lasts. In a defacement, the attacker gets enough access to change what a public web page shows, often replacing it with a political slogan.

These attacks are built for attention. They can take a county website offline for an afternoon or post a slogan on a public page. They rarely reach internal systems. The real damage is usually to public confidence, and it comes less from the attack itself than from how the organization talks about it.

The June 30 fact sheet expected hacktivist denial-of-service campaigns against U.S. and Israeli websites. It also described the hack-and-leak operations Iranian-affiliated actors ran after the Israel-Hamas war began in 2023. Those operations combined data theft with online amplification and harassment through direct messages. Their aim, the fact sheet said, was to undermine confidence in victims’ security and to embarrass them. Because the attacker’s goal is the headline, the response belongs with the people who manage headlines.

Protection that is often already paid for

The defenses are well known and mostly contractual. Denial-of-service protection for public sites is usually available through the hosting provider or a content delivery network, and the time to confirm it is switched on is before an alert. A content delivery network is a service that keeps copies of a website on many servers around the world and absorbs sudden surges of traffic, so a flood of junk requests hits its large infrastructure rather than the county’s small one. For many agencies the protection is already in the contract; someone simply needs to check that it is turned on.

Publishing rights for websites and social media accounts should be limited to named staff with multifactor authentication. Multifactor authentication, or MFA, means a password alone is not enough to log in; the person also needs a second proof, such as a code on their phone. It is one of the most effective and cheapest controls an organization can adopt, and it closes off the most common route to a defaced page: a stolen or guessed password.

Contracts and settings to confirm

Confirming protection is a short, specific task. The web team should know which provider fronts each public site, whether denial-of-service mitigation is included in the plan, and whether it is always on or must be requested. Some plans protect only the main domain, leaving payment portals, permit systems or older microsites exposed. Many agencies run a dozen or more public services hosted by different vendors, from utility billing to court records search. Each one needs the same check, and each vendor contract should say who responds when the site is flooded.

Social media accounts need their own inventory. Departments often open accounts for parks, libraries or emergency management without telling IT. The communications office should hold a list of every official account, the people with publishing rights, and the recovery email and phone number for each. A hijacked parks account that posts a political slogan is a minor incident. Losing that account for weeks because nobody knows its recovery address does more harm.

The real risk is a premature statement

The hardest part is communications. The usual error is treating an unverified claim of a breach as confirmed. Hacktivist groups often announce on social media that they have stolen data from a city. Sometimes the claim is invented; sometimes it is recycled from an old, unrelated incident. A local reporter calls within the hour. If a city official confirms a “breach” before anyone has checked, the agency has done the attacker’s publicity work for it, and may have triggered legal notification duties for no reason.

A holding statement drafted in advance, a quick technical check, and a named spokesperson who waits for that check will handle most incidents. Suppose a county’s website goes down at 10 a.m. on a Tuesday, and a group claims on a messaging channel to have “destroyed” the county’s systems. The communications director pulls a pre-approved statement — “We are aware of an issue affecting our public website. Core county services are operating normally and we are investigating” — and posts it from the county’s social channels. The web team confirms with the hosting provider that this is a traffic flood, not an intrusion. By early afternoon the site is back, and the follow-up statement is short and factual. Nobody had to guess.

Checking a claim before answering it

The technical check behind a holding statement is short. It establishes three facts. The first is whether the outage comes from traffic volume, a hosting fault or changed content. The second is whether any internal system has shown unusual sign-ins. The third is whether the data offered as proof matches anything the agency holds, or is older public data repackaged. A security vendor or an information-sharing group can often help compare leaked samples against known earlier breaches.

Legal notification duties depend on whether personal information was actually accessed, under state law and any sector rules that apply. That decision should rest with counsel and the privacy officer, on evidence. A useful house rule is that nobody uses the word “breach” in public until counsel has agreed it applies.

The cost of caution

The cautious approach carries its own risk. If a claim later proves true, an agency that said “core services are operating normally” may look evasive. The holding statement should therefore be accurate on its own terms. It says what is known and that an investigation is under way, without denying what has not yet been checked. That wording protects the agency whichever way the facts turn out, and it keeps the spokesperson’s credibility intact for the follow-up.

This threat belongs to the communications director and the web team, not the security operations center.

The 911 wrinkle

Public safety agencies need one extra check. If a hacktivist group targets a city’s main website, residents may turn to 911 or non-emergency lines for information. Dispatch centers should know where to route those calls, and the city’s alert system should be ready to publish updates from a channel that does not depend on the affected site. An emergency line clogged with “Is the city website hacked?” calls is a real public safety problem, even if the website outage itself is trivial.

Dispatch centers also face a related attack aimed at phones rather than websites. A telephony denial-of-service attack floods administrative or emergency lines with automated calls and ties up call-takers. Federal agencies have warned public safety answering points about this technique for years. The defenses lie with the phone carrier and the 911 system provider, so the dispatch director should know whom to call and what the provider can filter. Next Generation 911 systems, which carry calls over internet protocol networks, widen the set of components that need protecting. They also make the 911 authority’s contract with its network provider part of its security posture.

Opportunistic intrusions: days, and owned by public works

The second threat matters most to utilities and public works departments, and it is the one where physical consequences are possible.

What a controller is, and why exposure matters

At the heart of most water systems, pump stations and many building systems are programmable logic controllers, or PLCs. A PLC is a small, rugged industrial computer that does one job reliably: read sensors, apply simple rules and switch equipment on or off. It might keep a tank between two levels, or add the right dose of a chemical as flow changes. Operators usually see and adjust these devices through a control screen.

Many PLCs were designed decades ago on the assumption that they would sit on closed, private networks inside a plant. Over time, for convenience, many were connected to the internet so that a vendor could provide remote support or an operator could check a station from home. Too often that connection was made with the device’s factory settings still in place, including a default password that is printed in the manual and easy to find online.

What happened in 2023

In late 2023, actors that U.S. agencies linked to Iran’s Islamic Revolutionary Guard Corps compromised internet-exposed programmable logic controllers made by an Israeli company. Victims included a water authority in Pennsylvania. The attackers often used default passwords. Their success came from devices reachable from the internet with factory settings, not from sophistication.

These attackers did not need to be brilliant. They searched for devices that were visible from the internet and still had their factory passwords, and they walked in. The target was chosen by convenience. That is what makes this category “opportunistic”: if your device is exposed, you are on the list whether or not anyone has heard of your town.

How the 2023 campaign worked

CISA’s advisory on that campaign, AA23-335A, set out the mechanics. The actors targeted Unitronics Vision Series controllers, which have a built-in operator screen. They connected over the device’s default network port, 20256, to units with a default password or no password at all. Once in, they erased the original control logic and loaded logic that did nothing. They renamed devices, moved the communication port and disabled uploads and downloads, all of which slowed recovery. On the operator screen they left an anti-Israel defacement message that hid the normal readings.

The advisory counted at least 75 compromised devices between November 2023 and January 2024, at least 34 of them in the U.S. water and wastewater sector. It also noted that the same controllers are sold under other brand names, so an asset list that searched only for one manufacturer could miss them. Recovery depended on preparation. The advisory’s follow-up steps included backing up controller logic and configurations and keeping spare hardware on hand. A utility with both could restore a device in hours. One without had to wait for its integrator to rebuild the logic from scratch.

What the June 2025 fact sheet asked for

The June 2025 fact sheet repeated the basic guidance: take operational technology off the public internet, change default passwords, require multifactor authentication for remote access and keep systems patched. Patching means installing the fixes that manufacturers release when they discover flaws in their software.

The steps are not exotic. For a small utility with one or two technical staff, the hard part is knowing which devices are exposed. CISA’s free vulnerability scanning service for public entities can identify internet-facing assets. So can a simple review of the remote access paths that integrators and equipment vendors set up during installation, which are often undocumented. An integrator is the contractor who designs and installs a control system; a well-meaning one may have opened a remote connection years ago to make support calls easier and never written it down.

The fact sheet’s list, read as a work plan

The June 2025 fact sheet’s mitigations translate into a sequence an operations lead can run. First, find exposure. The fact sheet singled out remote access tools: virtual network computing (VNC), remote desktop (RDP), Secure Shell (SSH), and the web management pages built into operator screens and VPN appliances. Second, remove it. Where remote access cannot be removed, the fact sheet asked for a deny-by-default allowlist, so only known addresses can connect. Third, replace weak and default passwords and require phishing-resistant MFA for anyone reaching the OT network from another network. Fourth, patch internet-facing systems. Fifth, watch remote access logs and any firmware or configuration change.

The last group of recommendations is different in kind: it limits harm rather than preventing entry. The fact sheet asked operators to keep controllers in run mode rather than program mode, so their logic cannot be changed remotely without a deliberate step on site. It also pointed to hardware or software interlocks, safety systems and redundant sensors. A physical interlock that stops a chemical feed pump when a reading goes out of range works even if the controller behind it has been tampered with. These measures are engineering decisions, so they belong to the operations lead and the plant engineer rather than the IT department.

Why this is the category for a sprint

This is the one category where a bulletin should trigger a sprint. A list of exposed devices, an owner in operations for each, and a deadline measured in days will remove the easiest targets. Because the attackers are opportunistic, each device removed from public view takes the agency off a target list.

The trade-off is operational. Pulling a controller off the internet may break a vendor’s remote support or an operator’s ability to check a pump station from home. Utilities should replace those paths with a managed remote access service that requires multifactor authentication, instead of restoring the exposure after the alert fades.

Take a small utility whose general manager asks the operations supervisor for a list of every device that can be reached from outside the plant. The supervisor requests a scan through the free federal service and calls the two integrators who have worked on the system. Within a week they have found three exposed controllers, one of them with its factory password unchanged. The password is changed that afternoon. The controllers are taken off the internet by the end of the week, and the vendor’s remote access is moved to a managed service with MFA. Operators lose the ability to log in from a personal laptop at home; they gain a supported route that is logged and protected.

Watching as well as locking

Monitoring matters as much as removal. Few small utilities watch their control networks for unexpected logins or setpoint changes. A setpoint is the target value a controller works toward, such as a tank level or a chemical dose. An unexpected change to a setpoint is exactly the kind of signal that something is wrong.

Basic alarms on remote sessions outside working hours, reviewed by the operator on duty, are cheap and catch the kind of tampering seen in 2023. State drinking water programs and utility associations can help small systems share that monitoring instead of building it alone.

Who does the work at different kinds of utility

The owner of this sprint varies with the organization. At a large utility with its own OT security staff, it is a normal change ticket with a named engineer. At a small town system run by a licensed operator and a part-time contractor, the operator owns the plant but rarely owns the network, and the integrator holds the knowledge. A wastewater district may share an integrator with neighboring towns. One well-run sprint can then fix several systems, and one poor practice can expose them all.

The same pattern appears outside water. County buildings, jails, hospitals and airports run building automation: chillers, air handlers, generators and door access panels installed by facilities contractors. Those systems are often reachable from the internet for the contractor’s convenience and are rarely on the IT department’s asset list. The fact sheet’s advice applies to them unchanged, and the facilities manager is the natural owner.

The cost and the evidence

The sprint costs mostly staff and contractor time: a scan, a few days of integrator hours and a managed remote access subscription. The evidence it produces is useful beyond the alert. A dated list of exposed assets, the changes made and the new remote access design are exactly what a water system’s next Section 1433 review should reflect.

Regulators had already flagged this gap. In May 2024, the EPA issued an enforcement alert saying more than 70 percent of the systems it had inspected since September 2023 violated basic Section 1433 requirements. It described systems that had not changed default passwords, used a single login shared by all staff, or had not removed former employees’ access. A sprint triggered by a geopolitical alert closes the same findings an inspector would write up.

Targeted operations: years, and owned by the CISO

The third threat comes from capable state-affiliated actors pursuing espionage, prepositioning or disruption against chosen organizations. Espionage is covert information gathering. Prepositioning means getting access now and holding it in reserve, so that systems can be disrupted later if a conflict escalates. Disruption is the use of that access to cause damage.

Their operations are low-profile and may not follow the news cycle. A ceasefire on the evening news does not mean these actors have packed up; they may have begun months earlier and may continue long after.

The ransomware connection

The June 30 fact sheet added a twist that blurs the line between espionage and crime. Iranian-affiliated actors, it said, had worked directly with ransomware affiliates, helping encrypt victims’ networks and steal data to leak online. For a local government, a state-linked intrusion can therefore end the way a criminal one does: with locked servers and a ransom demand. The ransomware plan and the targeted-intrusion plan should be one plan, with the same forensic retainer, the same counsel and the same decision makers.

How patient access is usually gained

Targeted actors rarely need novel tools. Common routes into government networks include unpatched edge devices such as VPN gateways and firewalls, stolen or guessed passwords for remote access accounts, and trusted connections from service providers. Once inside, capable actors tend to use the network’s own administrative tools rather than obvious malware, which makes them harder to spot. Detection therefore depends on knowing what normal administrator behavior looks like: which accounts sign in, from where, at what hours and to which systems.

Who should worry most

Agencies with defense, energy or emergency management roles, or deep federal partnerships, are more likely to be of interest than a typical municipal office. Even so, a small county can be a stepping stone to a state network it connects to. Attackers often enter through the least-defended organization in a chain of connected networks and then move toward the real prize.

Defenses that take budget cycles, not days

Defenses here are slow to build and cannot be stood up in the week a bulletin appears. They start with phishing-resistant authentication for administrators and monitoring of privileged account use.

Two terms matter here. An administrator, or privileged account, is a login with the power to change the system itself: create users, alter settings, read everyone’s data. Attackers prize these accounts above all else. Phishing-resistant authentication is a stronger form of MFA, typically a physical security key or a device-based passkey, that cannot be fooled by a fake login page. Ordinary text-message codes can be tricked out of people; a hardware key cannot be.

Logs must be kept long enough to investigate an intrusion months after it began. Logs are the records systems keep of who signed in, from where and what they did. If they are overwritten after thirty days, an intrusion discovered after six months cannot be reconstructed, and the agency cannot say with confidence what was taken or changed.

For a benchmark, federal agencies follow OMB memorandum M-21-31, which sets logging requirements that include keeping key logs for twelve months in active storage and longer in cold storage. Local governments are not bound by it. It still offers a defensible reference point when a budget committee asks how long is long enough.

What the investment looks like by size

A state agency or large county can run a security operations center, or buy one as a managed service, keep logs centrally and hunt for suspicious behavior. A small town cannot. Its realistic version is narrower. It means phishing-resistant keys for the handful of administrator accounts, including the MSP’s. It means logs from email, identity and VPN sent to a service that keeps them for at least a year. And it means an agreement with the state or a provider for help when something is found. Some states offer shared security services to local governments, which can make the narrow version affordable.

Agencies also need relationships with state fusion centers and the MS-ISAC so that indicators arrive quickly. Fusion centers are state and regional hubs where federal, state and local agencies share threat information. The MS-ISAC, the Multi-State Information Sharing and Analysis Center, serves state, local, tribal and territorial governments by passing along warnings and technical clues. “Indicators” are those clues: the internet addresses, file signatures and behaviors that reveal a known attacker.

The supply chain problem

Managed service providers and integrators with remote access deserve particular attention, because a compromise of one provider can reach many local governments at once. A managed service provider, or MSP, is an outside firm that runs IT for an organization, often for many small towns at once from a single central console. That central console is efficient for the provider and attractive to an attacker: breach it once, and you can reach every client.

Contracts should require multifactor authentication, documented access paths and prompt notice of incidents at the provider.

Contract language matters most at renewal, which is when an agency has the most bargaining power. Useful terms include a list of every person and tool with access to agency systems, and phishing-resistant MFA on the provider’s own administrative console. They also include a notice period for provider incidents measured in hours rather than weeks, and the right to receive relevant logs. Small towns that buy through a cooperative purchasing contract or a state-negotiated vehicle may find some of these terms already available. Where they are not, the state can sometimes add them for every buyer at once.

Busy is not the same as ready

The mistake in this category is spending a heightened-alert week on activity that looks busy, such as extra all-staff emails, instead of checking whether logging would actually support an investigation. A useful test is to ask the security team to reconstruct one administrator’s sign-ins from six months ago. If it cannot, the investment priority for the next budget cycle is clear.

The case for spending on a threat you cannot see

A council member could fairly object that a small town should not fund defenses against nation-state actors who are unlikely to care about it. The answer has two parts. First, the controls that frustrate state actors are the same controls that stop ransomware crews: strong administrator authentication, long log retention and provider accountability. Ransomware crews hit local governments far more often than state actors do. Second, the town’s value to an attacker may lie in its connections rather than its own data: a shared state network, a law enforcement system, or an MSP console that reaches its neighbors. The spending is justified without assuming the town is a target in its own right.

Putting the three together: a playbook for the next alert

The value of sorting threats this way is that it turns a single alarming message into a short, assignable plan. A county administrator or utility general manager can lay it out on a single page:

• Nuisance (hours). Owner: communications director and web team. Actions: confirm denial-of-service protection is on; confirm publishing accounts use MFA; have the holding statement ready; brief the dispatch center on routing information calls.
• Opportunistic (days). Owner: operations or public works lead. Actions: list every internet-exposed device; change default passwords; remove exposure; replace vendor shortcuts with managed remote access; switch on alarms for out-of-hours remote sessions.
• Targeted (years). Owner: the CISO or the senior person responsible for security. Actions: phishing-resistant authentication for administrators; monitoring of privileged accounts; adequate log retention; relationships with the fusion center and information-sharing groups; tighter contracts with providers.

Running the first 72 hours

A heightened-alert week has a natural rhythm. On day one, the administrator or general manager confirms the three owners and asks each for a short status by the next morning. The communications lead confirms the holding statement and the denial-of-service settings. The operations lead starts the exposure list. The CISO checks that logging works and that warnings from the MS-ISAC or fusion center reach the people who can act on them. By day three, the opportunistic sprint should have a list and a schedule, and the other two owners should have confirmed readiness or named a gap.

Measuring the three differently

Each category needs its own measure. For nuisance attacks, the useful number is time to an accurate public statement. For opportunistic exposure, it is the count of internet-reachable OT devices and default credentials, which should fall to zero and stay there. For targeted threats, it is coverage: the share of administrator accounts on phishing-resistant MFA, and the number of months of logs that can actually be searched. A single “cyber readiness” score blends these and hides which one is failing.

Three errors recur. One is putting everything on the security team, which drowns it in hacktivist noise. Another is treating the opportunistic sprint as a one-off, then restoring the old remote access when a vendor complains. A third is confusing an uneventful week with a safe one. The targeted category, by its nature, generates little visible activity.

The costs of getting this wrong also differ by category. A nuisance attack mishandled costs reputation and staff time. An opportunistic intrusion into a water controller could cost public health, regulatory scrutiny and emergency spending. A targeted intrusion discovered late could cost months of investigation, outside forensic fees and difficult conversations with state partners whose networks connect to yours.

Where the playbook strains

The split assumes three people to own three categories. In a very small agency, one person may hold all three roles, along with running the network. The playbook still helps, because it tells that person what order to work in. The opportunistic sprint comes first, since it removes physical risk fastest. The holding statement comes second, since it costs an hour. The targeted work becomes a budget request with a clear rationale. A neighboring larger agency, a state program or a contracted provider can fill the gaps that remain.

What a leader can check before the next bulletin

A leader does not need to be technical to hold a team accountable. These questions are plain, and each has a clear answer:

1. Who owns our response to a hacktivist claim, is a holding statement ready today, and who has confirmed that denial-of-service protection is switched on for our public website?
2. If our website goes down, does the 911 center know how to route information calls, and can we alert residents through another channel?
3. Do we have a current list of every device in our water, wastewater or other operational systems that can be reached from the internet, and how do we know the default password on every controller has been changed?
4. Which vendors, integrators and managed service providers have remote access to our systems, is that access documented and protected by multifactor authentication, and must they tell us promptly if they are breached?
5. Would we notice if someone logged into a control system at 2 a.m. or changed a setpoint, and can we reconstruct one administrator’s sign-ins from six months ago?

If the answers come back quickly and confidently, the agency is in good shape for the next bulletin. If they come back as “we’ll have to check,” the leader has learned where to start.

Answers that should reassure

Strong answers are specific. The communications director names the provider and the date the denial-of-service setting was last checked. The operations lead produces a dated list of exposed devices, even if it is short. The CISO can show a sign-in record from six months ago within minutes rather than promising to find one. Weak answers point to a vendor without evidence, or to a policy rather than a test.

Keeping the answers current

These questions deserve a schedule as well as a trigger. Network changes, new vendors and staff turnover reopen gaps that were closed. A quarterly check on the operational items and an annual check on the targeted items keep the answers current. A change in the threat environment is a reason to ask early, and the schedule ensures somebody asks in the calm months too.

Elected bodies have a role as well. A council or utility board that asks for the answers once a year, in writing, gives staff a reason to keep them current and creates a record that oversight took place. For larger water systems, the same record supports the Section 1433 certification. For agencies applying for state or federal grants, it shows a baseline against which progress can be measured.

With hindsight

The ceasefire held through the summer of 2025, and the large-scale retaliatory campaign some feared against U.S. infrastructure did not materialize in that period. Hacktivist denial-of-service activity and claims of compromise did follow, consistent with the bulletin’s assessment. Federal agencies kept warning that Iranian actors might target exposed operational technology.

The bulletin itself was set to expire on September 22, 2025. The June 30 fact sheet remained the reference for the period. Its most useful content for local agencies was its mitigation list, which repeated steps that CISA and the EPA had urged on water utilities since the 2023 controller campaign. CISA had revised its advisory on that campaign as recently as December 2024, adding newly observed techniques. The threat was continuous, and the June alert was a reminder of work that was already overdue for many systems.

The three-way split held up. The noisy threat showed up quickly and loudly, much as expected. The opportunistic threat remained a standing concern for anyone with exposed controllers, regardless of headlines. And the absence of a dramatic campaign said little about the targeted category, which by design does not announce itself.

The support structure for local agencies also changed. On September 30, 2025, CISA’s cooperative agreement funding the MS-ISAC ended, and the center moved toward a paid membership model. Small governments that relied on free federal services had less to lean on when the next alert came.

The details of that change mattered to small budgets. According to the Center for Internet Security, DHS announced on September 29, 2025 that it would not continue funding, and the paid model took effect on October 1. Membership came in tiers scaled to budget. Governments that did not join faced a phased offboarding from MS-ISAC services over the following weeks and months. Some resources stayed free to state, local, tribal and territorial governments, including the CIS Benchmarks and CIS SecureSuite.

That shift matters to anyone setting a local budget. Information sharing, warnings and support that once arrived at no cost now carry a price or require a deliberate decision to join. For a small town or utility, that turns cyber defense from something partly provided by others into something the agency must choose to fund. Councils and boards that never saw a line item for it may now need to.

For water utilities, the regulatory baseline stayed where it was. The Section 1433 duties remained in force, and the EPA’s 2024 enforcement alert remained the clearest public statement of what inspectors were finding. The gap it described, default passwords, shared logins and former staff who still had access, is the gap the June 2025 fact sheet targeted. Utilities that closed it after the alert had a record to show at their next assessment review. Those that did not still faced the same findings.

One part of the analysis aged less well than we would like. The split assumed that a local agency could lean on outside help for the targeted category: federal scanning, state fusion centers and a free information-sharing center. The loss of free MS-ISAC membership weakened that assumption for the smallest governments. The targeted category now depends more on what each agency chooses to buy or share with its neighbors, and less on what arrives by default.

The practical conclusion is straightforward. A heightened alert is a poor time to begin basic work, and a good time to confirm that it is already done. Agencies that used June 2025 to remove exposed controllers and default credentials will not have to do that work under pressure when the next bulletin appears. Those that did not still can, and the cheapest moment to do it is a calm one, before the next headline, when vendors are available, staff are not stretched and nobody is watching the clock.