In attacks reported from November 2023 to January 2024, pro-Russia group CyberAv3ngers reached internet-connected Unitronics Vision Series programmable logic controllers (PLCs) where default or absent passwords left access exposed. The incidents show why utilities must protect the whole access path—not assume every PLC lacks authentication or that a gateway alone makes it secure.
What happened in the Unitronics PLC attacks?
A joint advisory from CISA and partner agencies says CyberAv3ngers targeted U.S.-based Unitronics Vision Series PLCs in likely four waves between November 2023 and January 2024. The advisory reported at least 75 compromised devices overall, including at least 34 in the U.S. Water and Wastewater Systems sector. Attackers reached internet-connected devices through TCP port 20256 when default passwords or no password were in place. CISA’s advisory
As an Amazon Associate I earn from qualifying purchases.
According to the advisory, the attackers erased original ladder logic and downloaded their own logic, which contained no inputs or outputs. They also disrupted devices and hindered operators’ ability to remediate them remotely. Those findings establish compromise and operational disruption; they do not establish that the incidents contaminated water or caused a confirmed public-health outcome.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy does PLC authentication need more than a password?
A PLC is an operational controller: access to its programming or management functions can affect its logic or operating state. The headline’s suggestion that the control layer was “never designed to authenticate” is too broad as a statement about all PLCs. The documented incident concerns a particular Unitronics product family exposed with default or absent passwords. The practical security question is where identity checks and access restrictions are enforced across the controller, engineering workstation, and network boundary.
#1 Best Overall
CISA recommends strong, unique passwords; removing defaults; disabling authentication methods that are not needed; authenticating field-controller management sessions; restricting who can change operating modes; and using host allowlists. Where a PLC cannot perform multifactor authentication (MFA) itself, a VPN or gateway can enforce MFA for remote access. That protection depends on correctly maintaining the surrounding access system and does not make the PLC or connected network secure by itself. CISA’s recommendations
How should a utility limit remote access?
Remote access may be operationally necessary, but a controller should not be directly reachable from the public internet. CISA recommends putting a proxy, gateway, firewall, or VPN in front of a PLC when remote access is required, with rules that resist repeated login attempts. Utilities should also segment operational technology (OT) from business networks and restrict access to only the users and systems that need it. VPNs require ongoing maintenance; they are one control in a layered design, not a substitute for segmentation or sound account security. CISA’s advisory and related guidance
Rank #2
- -- PLC Type: Fully compatible with FX1S, 10 Transistor Input (NPN Type), 7 Relay Output. Have additional 4 Transistor Output: 2 for high speed pulse 100KHz & 2 for direction, can drive 2 servos or 2 steppers with pulse, built-in 2AD（0-10V) and 2DA(0-10V), also 2 NTC10K B3435 probe. Just read the address of AD DA NTC's will ok, 2 high speed input 100KHz X0 X1 to control encoder
- -- PLC software: Use GX Workers 2 or Developer (pls download from GX Workers 2 website, we only have Chinese version), support Command + T Ladder Diagram + SFC for programming
- -- HMI Software: YKBuilder V5.3 and Choose FE serial 380 model in HMI software. (Pls contact us, we will share it and the video instruction and guidelines), very easy to use, just create the buttun and set the address
- -- Use the same Cable for download program from PC to PLC/HMI: Use the: mini port – USB cable, pls install HMI & PLC’s USB driver first, which we will share.
What should water utilities prioritize?
A February 2024 fact sheet from CISA, EPA, and the FBI lays out practical priorities for water and wastewater systems. The agencies’ fact sheet and EPA/CISA guidance recommend:
- Reduce public-facing internet exposure and assess cybersecurity risks.
- Change default passwords and use MFA broadly, at minimum for remote access to OT networks.
- Inventory OT and IT assets, and keep accurate records of current configurations, including software and firmware versions.
- Reduce vulnerabilities, maintain backups of OT and IT systems, and exercise incident-response and recovery plans.
- Provide annual cybersecurity awareness training and OT-specific training for personnel who use OT systems. EPA/CISA water-system guidance
Recovery needs to be considered alongside prevention. A utility’s plans should account for how authorized staff will restore known-good configurations and safely regain remote access if a controller or its access path is disrupted; the agencies specifically call for backups and practiced response and recovery.
Rank #3
- -- PLC Type: Fully compatible with FX1S, 7 Input 5 Relay Output (24V pulse single). Have additional 4 Transistor Output: 2 for high speed pulse 100KHz & 2 for direction, can drive 2 servos or 2 steppers with pulse
- -- PLC software: Use GX Workers 2 or Developer (pls download from GX Workers 2 website, we only have Chinese version), support Command + T Ladder Diagram + SFC for programming
- -- HMI Software: YKBuilder V5.3/7.0 (Pls contact us, we will share it and the video instruction and guidelines). For HMI model: pls choose FE Serial, 280D
- -- Use the same Cable for download program from PC to PLC/HMI: Use the: mini port – USB cable, pls install HMI & PLC’s USB driver first, which we will share.
What do the incidents say about physical risk?
The Unitronics advisory documents compromised devices and disruption, not a confirmed water-contamination event. Separately, a CISA and partner-agency fact sheet describes pro-Russia hacktivist activity against small OT systems as appearing mostly limited to unsophisticated nuisance effects, while noting that investigations found capabilities that could pose physical threats in insecure and misconfigured OT environments. That broader risk characterization should not be mistaken for evidence of physical harm in the Unitronics incidents. CISA and partners’ fact sheet
Quick Recap
Best Value
- The PL2303GT chip is 1 of the latest G-Series IC product added to the popular PL2303 USB to Serial
- (UART) Bridge Controller family, replacing the PL2303RA USB to RS232 serial chip. It provides an advanced
- full-featured single-chip bridge solution for connecting a full-duplex UART asynchronous serial interface
- device to any Serial Bus (USB) capable host. The PL2303GT provides highly compatible USB
- drivers to simulate the traditional COM port (via virtual COM Port) on most operating systems allowing
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
