Listen to this Post
Introduction: A Silent Threat Flowing Through Critical Infrastructure
Critical infrastructure has become one of the most attractive targets for modern cybercriminals and nation-state threat actors. While attacks against corporate networks often result in financial losses, successful compromises of industrial control systems (ICS) can directly impact public safety, essential services, and even human lives. The latest findings from cybersecurity researchers reveal an alarming reality: thousands of industrial controllers responsible for managing water infrastructure remain directly accessible from the public internet.
Following a series of coordinated cyberattacks that disrupted water facilities across multiple U.S. states, researchers have discovered over 4,400 internet-facing Rockwell Automation controllers exposing industrial communication services. Although exposure has gradually declined over recent years, the remaining devices continue to present an attractive attack surface for adversaries seeking to disrupt critical infrastructure.
Coordinated Attacks Disrupt Water Systems Across the United States
A newly published report from Forescout Research – Vedere Labs reveals that 4,407 Rockwell Automation/Allen-Bradley industrial controllers are currently accessible from the internet through EtherNet/IP (Port 44818).
The report was released on August 5, 2026, shortly after a wave of coordinated cyber incidents affected municipal water utilities across the United States.
The campaign first became publicly known after Minnesota IT Services disclosed a coordinated attack impacting more than 30 municipal water systems throughout the state.
Several municipalities—including Plymouth, South St. Paul, Maple Plain, and Braham—confirmed operational disruptions affecting their water infrastructure.
Although investigators have not officially attributed the attacks to any specific threat group, the scale and coordination of the incidents have significantly increased concerns surrounding industrial cybersecurity.
How the Water Facilities Were Compromised
Individual municipalities experienced different attack scenarios depending on how their industrial equipment was connected.
In Braham, malware delivered through a wireless connection successfully disabled water plant control systems, interrupting normal plant operations.
Meanwhile, Plymouth reported that the targeted infrastructure—including two water towers and 14 sewer lift stations—communicated through cellular connections.
Just two days after the Minnesota attacks became public, the FBI and EPA jointly confirmed similar cyber incidents affecting additional states.
Authorities identified attacks impacting:
Nine municipal water systems in Michigan
One wastewater lift station in South Dakota
Additional infrastructure in Georgia
The incidents demonstrate that attackers are not focusing on a single municipality but appear to be targeting similar industrial environments across multiple regions.
Industrial Controllers Became the Primary Target
According to investigators, the attackers specifically focused on Allen-Bradley MicroLogix 1100 and MicroLogix 1400 Programmable Logic Controllers (PLCs).
Rather than simply stealing information, the attackers manipulated industrial operations by:
Modifying PLC logic
Changing IP configurations remotely
Resetting controller passwords
Interrupting monitoring capabilities
Disrupting operational visibility
These changes created serious operational risks including:
Water pressure loss
Loss of remote monitoring
Increased flooding risk
Possibility of untreated groundwater entering drinking water systems
Unlike traditional ransomware attacks, these actions directly affect physical processes, making operational technology attacks particularly dangerous.
Over 4,400 Industrial Controllers Remain Internet Accessible
Researchers performed Shodan scans on August 3 and identified 4,407 publicly reachable industrial controllers exposing EtherNet/IP services.
The geographic distribution reveals where exposure remains highest:
United States — 65%
Canada — 12%
Spain — 3%
Remaining devices distributed across numerous countries
Perhaps even more concerning, over 70% of exposed U.S. controllers appear to communicate through large cellular carrier networks using industrial cellular routers.
This finding closely aligns with the FBI and EPA advisory describing remotely connected municipal infrastructure.
MicroLogix Controllers Continue to Dominate Exposure
Among all exposed devices, older industrial hardware continues to represent the majority of internet-facing systems.
Researchers identified:
MicroLogix 1400 — 50%
CompactLogix 1769 — 22%
MicroLogix 1100 — 8%
ControlLogix 5590 — 8%
While overall exposure has declined by approximately 47% since its peak in March 2020—dropping from 7,814 internet-accessible devices—the remaining systems continue to present significant security concerns.
Even a single exposed PLC controlling essential infrastructure can become an entry point for disruptive attacks.
Patterns Suggest Coordinated Infrastructure Deployment
Researchers also identified unusual similarities among affected systems.
Within 22 industrial hosts located in cities impacted by the current campaign:
86% operated through the same mobile carrier.
Fifteen devices located in Eagan, Minnesota shared:
Nearly identical firmware
Matching network configurations
Similar GPS coordinates
These characteristics strongly suggest centrally managed infrastructure or standardized deployments across multiple facilities.
While this simplifies maintenance, it may also enable attackers to reuse successful attack techniques across many targets.
Known Vulnerabilities Still Remain
At the time of publication, investigators have not confirmed any specific CVE exploited during the attacks.
However, numerous exposed devices remain vulnerable to previously disclosed security flaws.
One notable issue is:
CVE-2017-16740
This vulnerability affects Modbus TCP implementations and allows denial-of-service attacks under specific configurations.
Researchers observed that 19 of the 22 examined systems were susceptible.
Although exploitation requires Modbus TCP to be enabled—and there is no confirmation this occurred—the widespread presence of known vulnerabilities increases operational risk.
Compounding the issue is the lifecycle of the hardware itself.
Rockwell Automation discontinued the MicroLogix 1100 in 2022, meaning affected systems no longer receive security patches or feature updates.
Organizations continuing to rely on unsupported industrial hardware face growing cybersecurity challenges.
Poor Asset Management Creates Additional Security Gaps
The investigation uncovered security weaknesses extending beyond PLC exposure.
Researchers discovered:
Expired digital certificates
Forgotten VPN infrastructure
Abandoned remote-access services
Unused industrial hostnames
Legacy Microsoft IIS servers
One particularly striking example involved an expired certificate associated with a municipal utility that had served only a default IIS webpage since 2019.
These forgotten systems indicate incomplete asset inventories—a common weakness within operational technology environments.
Unused infrastructure often remains overlooked for years, quietly expanding an organization’s attack surface.
Recommended Mitigations for Critical Infrastructure Operators
Researchers urge organizations operating industrial environments to immediately reduce exposure by implementing several defensive measures.
Recommended actions include:
Block direct internet access to EtherNet/IP.
Restrict Port 44818 using strict allowlists.
Disable unnecessary Modbus TCP services.
Move cellular-connected infrastructure behind private APNs or VPNs.
Enforce multi-factor authentication for remote access.
Replace unsupported MicroLogix hardware.
Audit VPNs, certificates, and remote-access hostnames.
Remove abandoned or forgotten infrastructure.
Continuously monitor industrial environments for suspicious activity.
These measures significantly reduce the likelihood of unauthorized remote access to critical operational systems.
Deep Analysis
The recent attacks highlight a recurring issue within Operational Technology (OT): convenience often outweighs security. Direct internet exposure of PLCs dramatically increases the attack surface, allowing adversaries to identify and probe devices using widely available search engines such as Shodan or Censys. Even without exploiting a software vulnerability, weak passwords, exposed engineering services, or misconfigured remote access can provide a foothold.
Security teams can proactively identify exposed industrial services with controlled internal scanning and network monitoring.
Example Nmap Scan (Internal Authorized Networks Only)
nmap -Pn -p 44818 --script enip-info <target-ip> Detect EtherNet/IP Traffic
tcpdump -i eth0 port 44818
Identify Internet Exposure
nmap -Pn -p 44818 <public-ip-range> Review Firewall Rules (Linux)
iptables -L -n Restrict EtherNet/IP Access
iptables -A INPUT -p tcp --dport 44818 -s <trusted-ip> -j ACCEPT iptables -A INPUT -p tcp --dport 44818 -j DROP
Verify Listening Industrial Services
ss -tulpn | grep 44818
Monitor Active Connections
netstat -ant | grep 44818
Review VPN Authentication Logs
journalctl -u openvpn
Search for Legacy Certificates
find /etc -name ".crt"
Continuous Monitoring
Organizations should integrate OT-aware intrusion detection systems, maintain accurate asset inventories, segment industrial networks from corporate IT environments, and continuously audit remote access pathways. Regular firmware reviews, secure configuration baselines, and incident response exercises tailored for industrial environments are equally important to reduce operational risk.
What Undercode Say:
The discovery of more than 4,400 internet-facing PLCs is not simply another vulnerability report—it is evidence of a systemic challenge facing industrial cybersecurity worldwide.
Many organizations continue to treat operational technology as isolated infrastructure, despite years of digital transformation connecting factories, utilities, and municipal services to modern networks.
Internet exposure remains one of the easiest attack vectors to eliminate, yet it continues to appear in critical environments because of operational convenience, legacy deployments, and limited cybersecurity resources.
The attacks against water systems demonstrate that adversaries increasingly prioritize operational disruption over data theft.
Water treatment facilities are especially attractive because interruptions immediately affect communities and generate widespread public attention.
The heavy reliance on cellular routers shows that remote maintenance is becoming standard practice, but these connections must be protected with strong authentication and network segmentation.
Unsupported hardware such as the MicroLogix 1100 presents an expanding risk because newly discovered weaknesses can no longer be patched by the manufacturer.
The absence of a confirmed exploited CVE should not create a false sense of security.
Many successful OT intrusions begin with stolen credentials, exposed remote services, or poor network architecture rather than sophisticated zero-day exploits.
The discovery of abandoned certificates and forgotten infrastructure reveals another widespread industry problem: incomplete asset inventories.
Organizations cannot protect systems they no longer know exist.
Asset visibility should be considered the first layer of industrial cybersecurity.
The reduction in internet exposure since 2020 is encouraging, but thousands of exposed controllers remain.
Attackers require only one vulnerable entry point.
Defenders must secure every exposed asset.
Industrial cybersecurity is increasingly becoming an issue of national resilience rather than individual organizational risk.
Water, electricity, transportation, and manufacturing all depend on interconnected operational technology.
Future attacks are likely to become more automated, leveraging AI-assisted reconnaissance and faster exploitation of exposed infrastructure.
Organizations should assume continuous scanning by adversaries and design their environments accordingly.
Zero Trust principles should extend into operational technology wherever practical.
Network segmentation, strict access controls, continuous monitoring, and lifecycle management are no longer optional best practices.
They are essential operational requirements.
Public-private collaboration between utilities, government agencies, and cybersecurity researchers will become increasingly important.
Rapid information sharing significantly shortens the time between attack discovery and defensive action.
Investment in modern industrial security platforms should be viewed as protecting public safety, not merely IT infrastructure.
Municipal utilities often operate with limited budgets, making targeted funding and modernization initiatives essential.
Ultimately, cybersecurity for critical infrastructure is inseparable from national security.
Every exposed controller removed from the internet reduces the opportunities available to attackers.
The lesson from this campaign is clear: visibility, segmentation, and proactive defense are the strongest safeguards against the next wave of industrial cyber threats.
✅ Fact: Forescout Research reported approximately 4,407 internet-facing Rockwell Automation controllers exposing EtherNet/IP services, highlighting a substantial attack surface for industrial environments.
✅ Fact: Multiple U.S. water systems experienced coordinated cyber incidents, and public advisories from the FBI and EPA confirmed similar activity affecting infrastructure across several states.
✅ Fact: Although investigators identified several known vulnerabilities on exposed devices, no specific CVE has been confirmed as the exploit used in this campaign. The attacks may have relied on exposed services, weak configurations, compromised credentials, or other intrusion methods rather than a publicly disclosed software flaw.
Prediction
(+1) Industrial control system security will receive significantly greater investment over the next few years, with utilities accelerating the replacement of unsupported PLCs, expanding network segmentation, deploying OT-specific monitoring platforms, and enforcing zero-trust remote access. Governments and critical infrastructure operators are also likely to strengthen mandatory cybersecurity standards, reducing the number of internet-exposed industrial devices and improving resilience against future coordinated attacks.
▶️ Related Video (72% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.quora.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
