The CIP Briefing

A quiet week for new water-sector-specific advisories from CISA — but that does not mean a quiet week for your utility. CISA published a joint advisory on SafePay ransomware on October 20, a ransomware variant actively targeting critical infrastructure organizations including small and mid-size entities. If SafePay hits your utility, you're looking at encrypted SCADA historians, locked-out billing systems, and a 24-hour CIRCIA reporting clock on any ransom payment — plus the very real possibility of weeks of manual operations while you rebuild. Separately, CISA added a Siemens Software Center vulnerability (CVE-2026-110936) to the KEV catalog on October 20. This is a DLL sideloading flaw that attackers are exploiting via "ClickFix" campaigns (fake CAPTCHA prompts) to drop a genuine, digitally signed Siemens executable onto Windows engineering workstations to bypass antivirus. Because the attacker brings the signed Siemens software with them, your Windows workstations are vulnerable to this exploit even if your plant runs Rockwell/Allen-Bradley PLCs and has never used Siemens software. On the compliance calendar: the December 31, 2026 deadline for updated Emergency Response Plans for utilities serving 3,301–49,999 people under AWIA is now fewer than 10 weeks out. With Thanksgiving, December holidays, and year-end board meetings eating into your schedule, the realistic window to finalize your ERP is closing fast. If you haven't started the update, this week is the week to assign it.

🟡 [ACTIVE THREAT INTEL] #StopRansomware: SafePay Ransomware — Joint Advisory AA26-293A

On October 20, 2026, CISA published Cybersecurity Advisory AA26-293A under the #StopRansomware campaign, detailing the tactics, techniques, and procedures (TTPs) of the SafePay ransomware group. SafePay is actively targeting critical infrastructure organizations, including smaller entities that often lack dedicated security teams. The group gains initial access by brute-forcing VPNs (frequently routing attacks through Mullvad VPN IP addresses) and exploiting known vulnerabilities on edge and backup systems, specifically targeting Cisco ASA/FTD, SonicWall SonicOS, and Veeam Backup & Replication. Once inside, they abuse legitimate remote support tools like ScreenConnect, AnyDesk, and TeamViewer for persistence, use WinRM and PsExec for lateral movement, and deploy RClone and FileZilla to exfiltrate data before encrypting both IT and OT-adjacent systems with the .SafePay extension. To lock out defenders, they actively change system user passwords. Under CIRCIA, any ransomware payment must be reported within 24 hours of the payment, and a qualifying cyber incident must be reported within 72 hours of the moment a covered entity "reasonably believes" the incident has occurred.

Source: CISA Advisory AA26-293A — #StopRansomware: SafePay Ransomware

🟠 [CRITICAL VULNERABILITY] Siemens Software Center Uncontrolled Search Path Element — CVE-2026-110936 Added to KEV Catalog

On October 20, 2026, CISA added CVE-2026-110936 to the Known Exploited Vulnerabilities catalog. This is an uncontrolled search path element (DLL sideloading) vulnerability in Siemens Software Center (prior to V4.0.9.8). In the active "ClickFix" campaign, attackers use fake "I am not a robot" CAPTCHA or browser error prompts to trick users into opening the Windows Run box (Win+R) or PowerShell and pasting a malicious command. That command downloads a rogue installer that drops a genuine, digitally signed copy of SiemensSoftwareCenter.exe alongside malicious DLLs into the user's AppData folder. Because the Siemens executable is genuinely signed, Windows and antivirus tools trust it when it launches and sideloads the attacker's malware. This means an attacker can compromise a water utility's engineering workstation or operator HMI using this Siemens exploit regardless of whether the utility actually uses Siemens PLCs or software.

Source: NVD CVE-2026-110936

🔴 [REGULATORY MANDATE] AWIA ERP Deadline — Fewer Than 10 Weeks Remaining for 3,301–49,999 Population Tier

No new regulatory guidance was published in the past 7 days, but the compliance clock continues to tick. Utilities serving 3,301–49,999 people must submit updated Emergency Response Plans (ERPs) by December 31, 2026. (For this tier, the deadline to recertify Risk and Resilience Assessments (RRAs) was June 30, 2026, and must be completed before the ERP). For utilities serving 50,000–99,999 people, their updated ERPs were due June 30, 2026 (and RRAs due December 31, 2025) — those deadlines have already passed. If your utility is in the 3,301–49,999 tier and your ERP update is not actively underway, factor in Thanksgiving week, December holidays, board review cycles, and year-end operational demands. Your realistic working days to complete this federal requirement are disappearing.

Source: EPA Cybersecurity for the Water Sector