[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6s-rBsqR3sQoDnQZduImhF7bZzfb4o_eZfOTC1Vr0OE":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"cf7190dd-e6f9-4b29-b486-db990d884971","Nearly 4,000 US industrial devices exposed to Iranian cyberattacks","nearly-4-000-us-industrial-devices-exposed-to-iranian-cyberattacks-bdb849","The attack surface targeted by Iranian-linked hackers in cyberattacks against U.S. critical infrastructure networks includes thousands of Internet-exposed programmable logic controllers (PLCs) manufactured by Rockwell Automation. [...]","Iranian-affiliated APT groups have escalated cyberattacks against U.S. critical infrastructure, specifically targeting internet-exposed Rockwell Automation\u002FAllen-Bradley programmable logic controllers (PLCs) since March 2026. According to a joint federal advisory, attackers extracted device project files and manipulated HMI and SCADA displays, causing operational disruptions. Censys research found 5,219 internet-exposed Rockwell\u002FAllen-Bradley devices globally, with 3,891 (74.6%) located in the United States, many deployed on cellular modems.","Iranian state-backed hackers target ~3,900 exposed US industrial PLCs from Rockwell Automation since March 2026.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnearly-4-000-us-industrial-devices-exposed-to-iranian-cyberattacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F01\u002F28\u002FHacker-typing.jpg","2026-04-10T15:52:45+00:00","2026-04-10T16:00:06.351056+00:00",9,[17,20,23,26,28,31],{"name":18,"type":19},"Rockwell Automation","vendor",{"name":21,"type":22},"Allen-Bradley PLC","product",{"name":24,"type":25},"SCADA","technology",{"name":27,"type":25},"HMI",{"name":29,"type":30},"CyberAv3ngers","threat_actor",{"name":32,"type":30},"Handala","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21],{"controls":57,"vendors":145},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":88,"name":89,"problem":90,"products":91},"firewall","Next-generation firewall and intrusion prevention","Malicious traffic is blocked at the network edge and between zones.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png","sonicwall-firewalls","SonicWall firewalls","https:\u002F\u002Fwww.sonicwall.com\u002Fproducts\u002Ffirewalls","Next-generation firewalls for small business to enterprise.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"clavister","Clavister","\u002Fvendor-logos\u002Fclavister.png","clavister-netwall","Clavister NetWall","https:\u002F\u002Fwww.clavister.com\u002Fproducts\u002Fclavister-netwall\u002F","Next-generation firewalls developed in Sweden.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-firewall","Sophos Firewall","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fnext-gen-firewall","Next-generation firewall with intrusion prevention.",{"slug":117,"name":118,"problem":119,"products":120},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",[146],{"slug":147,"name":148,"logo_path":149,"roles":150},"censys","Censys","\u002Fvendor-logos\u002Fcensys.png",[151],"reported_by",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":163},"iranian-apt-groups-exploit-internet-exposed-industrial-control-systems","Iranian APT Groups Exploit Internet-Exposed Industrial Control Systems","Nearly 4,000 U.S. industrial control systems were left exposed to the internet, enabling Iranian APT groups to access and manipulate critical infrastructure since March 2026. The attackers successfully extracted device project files and disrupted HMI\u002FSCADA displays by targeting improperly configured Rockwell Automation PLCs that should never have been directly accessible from the internet. This incident highlights the catastrophic risk of placing operational technology (OT) systems online without proper network isolation and security controls. The widespread exposure of these devices demonstrates a fundamental failure in industrial cybersecurity architecture that could enable adversaries to cause physical damage or operational shutdowns.",[157,158,159,160,161,162],"CIS Control 12 (Network Infrastructure Management)","CIS Control 13 (Data Protection)","NIST SP 800-82 (Industrial Control Systems Security)","NIST CSF PR.AC-4 (Access Permissions)","IEC 62443-3-3 (Network Segmentation)","NERC CIP-005 (Electronic Security Perimeters)",{}]