[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fs1hBdHlZPpeKJUepMK85MVs6ksLV-Becbl61gikvqdA":3},{"article":4,"iocs":53,"watch_terms":61,"solutions":62,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"ce1ff6b5-b1ef-421c-8fb8-d88879aa46ca","Iranian attacks on US critical infrastructure puts 3,900 devices in crosshairs","iranian-attacks-on-us-critical-infrastructure-puts-3-900-devices-in-crosshairs-33dea6","Censys researchers warned that thousands of devices are exposed to the Iranian government’s campaign targeting energy, water, and U.S. government services and facilities. The post Iranian attacks on US critical infrastructure puts 3,900 devices in crosshairs appeared first on CyberScoop.","Censys researchers identified over 5,200 internet-exposed Rockwell Automation\u002FAllen-Bradley programmable logic controllers vulnerable to Iranian government cyber attacks, with nearly 3,900 deployed across US energy, water, and government facilities. The attacks, ongoing since March, exploited industrial automation devices primarily connected via cellular networks (Verizon and AT&T), with many running end-of-life software. Federal agencies (FBI, NSA, CISA, EPA, DoE, USCYBERCOM) issued joint alerts warning of active exploitation and financial losses to victims.","Iranian state-backed attackers target 3,900+ US critical infrastructure devices via exposed Rockwell Automation PLCs.","https:\u002F\u002Fcyberscoop.com\u002Firan-attackers-industrial-ot-government-energy-water-censys\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2022\u002F02\u002FGettyImages-a0028-000191.jpg","2026-04-09T21:29:16+00:00","2026-04-09T22:00:10.263407+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"Rockwell Automation","vendor",{"name":21,"type":22},"Allen-Bradley PLC","product",{"name":24,"type":22},"MicroLogix",{"name":26,"type":22},"CompactLogix",{"name":28,"type":29},"Iranian government","threat_actor",{"name":31,"type":19},"Censys","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"mitre_attack","T0849 - Modify Controller Tasking","PLC exploitation for industrial automation control manipulation",{"type":55,"value":59,"context":60},"T0801 - Activate Firmware Update Mode","Potential device firmware compromise in OT environments",[18,31,21],{"controls":63,"vendors":151},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"attack-surface-management","External attack surface management (EASM)","You find your forgotten internet-facing systems before attackers do.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","attack-surface-intelligence","Attack Surface Intelligence","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fattack-surface-intelligence","External attack surface management that discovers internet-facing assets and prioritises their exposures.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"detectify","Detectify","\u002Fvendor-logos\u002Fdetectify.png","surface-monitoring","Detectify Surface Monitoring","https:\u002F\u002Fdetectify.com\u002Fproduct\u002Fsurface-monitoring","Continuous discovery and testing of internet-facing subdomains and services.",{"slug":94,"name":95,"problem":96,"products":97},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"slug":123,"name":124,"problem":125,"products":126},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",[152],{"slug":153,"name":31,"logo_path":154,"roles":155},"censys","\u002Fvendor-logos\u002Fcensys.png",[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"iranian-cyber-attacks-exploit-thousands-of-unpatched-industrial-control-systems","Iranian Cyber Attacks Exploit Thousands of Unpatched Industrial Control Systems","Iranian government hackers successfully targeted over 3,900 critical infrastructure devices across US energy, water, and government facilities by exploiting vulnerable Rockwell Automation programmable logic controllers exposed to the internet. The attacks were enabled by poor vulnerability management practices, including the use of end-of-life software and failure to properly secure industrial control systems. This incident demonstrates how inadequate network segmentation and exposure of critical operational technology to public networks creates significant national security risks. The financial losses and operational disruptions highlight the critical importance of treating industrial control systems with the same security rigor as traditional IT infrastructure.",[162,163,164,165,166,167,168],"CIS Control 1","CIS Control 7","CIS Control 12","NIST SP 800-82","NIST CSF PR.IP-1","NIST CSF DE.CM-1","IEC 62443",{}]