Nearly 4,000 US industrial devices exposed to Iranian cyberattacks
Iranian state-backed hackers target ~3,900 exposed US industrial PLCs from Rockwell Automation since March 2026.
Iranian-affiliated APT groups have escalated cyberattacks against U.S. critical infrastructure, specifically targeting internet-exposed Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs) since March 2026. According to a joint federal advisory, attackers extracted device project files and manipulated HMI and SCADA displays, causing operational disruptions. Censys research found 5,219 internet-exposed Rockwell/Allen-Bradley devices globally, with 3,891 (74.6%) located in the United States, many deployed on cellular modems.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Rockwell Automation?
Get an email when a new story names Rockwell Automation, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonNearly 4,000 U.S. industrial control systems were left exposed to the internet, enabling Iranian APT groups to access and manipulate critical infrastructure since March 2026. The attackers successfully extracted device project files and disrupted HMI/SCADA displays by targeting improperly configured Rockwell Automation PLCs that should never have been directly accessible from the internet. This incident highlights the catastrophic risk of placing operational technology (OT) systems online without proper network isolation and security controls. The widespread exposure of these devices demonstrates a fundamental failure in industrial cybersecurity architecture that could enable adversaries to cause physical damage or operational shutdowns.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Next-generation firewall and intrusion prevention
Malicious traffic is blocked at the network edge and between zones.
- OT and industrial control system security
Factory, building and utility control systems get visibility and protection.