Iranian attacks on US critical infrastructure puts 3,900 devices in crosshairs
Iranian state-backed attackers target 3,900+ US critical infrastructure devices via exposed Rockwell Automation PLCs.
Censys researchers identified over 5,200 internet-exposed Rockwell Automation/Allen-Bradley programmable logic controllers vulnerable to Iranian government cyber attacks, with nearly 3,900 deployed across US energy, water, and government facilities. The attacks, ongoing since March, exploited industrial automation devices primarily connected via cellular networks (Verizon and AT&T), with many running end-of-life software. Federal agencies (FBI, NSA, CISA, EPA, DoE, USCYBERCOM) issued joint alerts warning of active exploitation and financial losses to victims.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Rockwell Automation?
Get an email when a new story names Rockwell Automation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonIranian government hackers successfully targeted over 3,900 critical infrastructure devices across US energy, water, and government facilities by exploiting vulnerable Rockwell Automation programmable logic controllers exposed to the internet. The attacks were enabled by poor vulnerability management practices, including the use of end-of-life software and failure to properly secure industrial control systems. This incident demonstrates how inadequate network segmentation and exposure of critical operational technology to public networks creates significant national security risks. The financial losses and operational disruptions highlight the critical importance of treating industrial control systems with the same security rigor as traditional IT infrastructure.
What helps against this
How we list vendors
- External attack surface management (EASM)
You find your forgotten internet-facing systems before attackers do.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- mitre_attack — T0849 - Modify Controller Tasking
- mitre_attack — T0801 - Activate Firmware Update Mode