Threat taxonomy
low activityCritical Infra ICS/SCADAFirst seen 2025
PumpControl Probe
Aliases: Water utility scanning cluster
Broad internet scanning and login attempts against water and facility control systems, occasionally reaching building management platforms at commercial sites.
Attribution
Unattributed, likely opportunistic
Primary targets
- — Water utilities
- — Building management
- — Commercial facilities
Observed tactics
- Mass credential stuffing
- Exploitation of unpatched HMI software
Regional relevance
Building management compromise at bank headquarters and data centres can affect cooling and physical access control.
Detection guidance
- Inventory building management assets and their exposure
- Enforce unique credentials on HMI accounts
- Patch or isolate legacy HMI software
Related feed reporting
- medium30 Aug 2026
Exposed industrial controllers found on power feeds serving data centres