When Intrusions Don't Align: A New Water Watering Hole and Oldsmar
Summary: Dragos investigated the February 2021 Oldsmar, Florida water poisoning attempt and found a Florida water utility contractor's WordPress site had been compromised with a fingerprinting script that profiled over 1,000 end-user computers during a 58-day window starting 20 December 2020. A City of Oldsmar computer browsed the compromised site at 14:49 UTC on 05 February 2021, the same morning an unknown actor reportedly accessed a water treatment plant HMI on that network and attempted to poison the water supply.
Key Takeaway: Dragos's best assessment is that the watering hole was deployed to harvest legitimate browser data for the Tofsee botnet's 'Tesseract' variant, not to breach water utilities - a reminder that an intrusion touching your network may serve an adversary's objective elsewhere, and that OT and ICS environments need control over access to untrusted websites.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026