Telecom Cyber Threats Linked to Water System Attacks

Analysis reveals overlap between telecom and water system cyberattacks. Unpatched vulnerabilities and exposed tech enable attackers, with AI accelerating reconnaissance. Telecom's central role amplifies risk to dependent infrastructure.

Vulnerabilities in the Telecom Landscape

The analysis says that the overlap in between both markets is architectural as opposed to subordinate. In the water assaults, internet-exposed operational modern technology and recorded protection defects produced openings for burglars. In telecommunications, the average driver in the research study had 15 typical vulnerabilities and direct exposures in its publicly visible assault surface area.

The paper draws on a broader telecom cybersecurity study of 3,106 drivers from a pool of 7,320 recognized with the Federal Communications Compensation public computer system registry. It argues that weaknesses seen in the water industry attacks, including unpatched recognized susceptabilities, exposed monitoring systems, and weak credential controls, are additionally common among smaller telecom carriers.

A 90-Day Roadmap for Operators

The paper sets out a 90-day roadmap for operators. Very early actions include auditing internet-facing management interfaces, cross-checking software and firmware versus the KEV brochure, and applying DMARC, DKIM, and SPF across organisational email domain names.

The record cites the National Institute of Criteria and Innovation Cybersecurity Framework and CISA’s resilience technique as identifying plunging failure throughout synergistic markets as a central threat. It places telecommunications near the centre of those dependency chains.

AI’s Role in Cyber Reconnaissance

According to the paper, some attackers utilized artificial intelligence tools to speed up reconnaissance and create scripts focused on specific Siemens PLC models. It cautions that the very same approach might be applied to telecom framework that relies upon out-of-date firmware, revealed management interfaces, and public-facing software with well-known susceptabilities.

That dependancy means interruption in telecommunications might compound the influence of a strike on another industry. In a water treatment event, signals to first responders, public cautions, and control between agencies all depend upon communications infrastructure.

SureShield and BorderHawk suggest that the main issue is not a lack of assistance. CISA advisories, NIST CSF 2.0, and Federal Communications Compensation cybersecurity assistance are currently available, yet numerous drivers do not have the personnel and tools to use them continually.

CISA verified that hackers breached greater than 100 internet-exposed water and wastewater systems throughout a minimum of 7 states, consisting of Michigan and Minnesota. The campaign was extensively attributed to Iran-linked actors targeting programmable reasoning controllers made by Rockwell, Schneider Electric, and Siemens.

“Our goal with the 2026 Telco Record was to provide the sector a mirror, to show, with proven information, what opponents already find out about their attack surface areas. The space between what protectors can see and what opponents can specify is wide, and it’s expanding,” claimed Chandrasekhar Bilugu, Principal Innovation Policeman, SureShield.

Researchers located that 41% of analysed drivers had validated dark web direct exposure, including leaked credentials, stolen arrangements, or jeopardized accounts. The paper says those problems develop a low-effort course for assaulters, who can gain access without establishing new exploits.

“The mix of AI-assisted reconnaissance and the volume of unpatched, internet-exposed properties across the telecom industry develops an intensifying threat. Operators can’t manage what they can not see, and enemies are increasingly seeing greater than we are,” stated Sanjaya Kumar, Ceo, SureShield.

Resource Constraints and Continuous Audits

SureShield and BorderHawk have actually published a whitepaper connecting current assaults on United States water systems to cyber danger in the telecommunications market. It claims 66% of the telecommunications drivers evaluated come under an elevated danger band.

Resource constraints are an additional reoccuring theme. SureShield claims 69% of US telecommunications drivers have fewer than 50 staff members, which it describes as a major barrier to maintaining traditional conformity and protection programs.

“When crucial national infrastructure like telecommunication services goes to risk of concession or unable to operate safely, everything downstream that depends on it is at danger also, and can face considerable disruption,” said Jay Harmon, Ceo, BorderHawk.

Their recommended answer is what they call continuous audit preparedness: maintaining a real-time picture of conformity and danger as opposed to preparing evidence just when an audit strategies. In method, that consists of monitoring susceptabilities against CISA’s Recognized Exploited Vulnerabilities brochure, keeping track of dripped qualifications, and maintaining control documentation present.