Back Securityaffairs.Co

Censys finds 5,219 devices exposed to attacks by Iranian APTs, majority in U.S.

Securityaffairs.Co •Pierluigi Paganini • April 11, 2026

Censys researchers found 5,219 exposed Rockwell PLCs online, mostly in the U.S., urging defenders to secure or disconnect them. On April 7, 2026, U.S. agencies, including FBI, CISA, and NSA, warned of Iran-linked APTs exploiting internet-exposed Rockwell Automation PLCs. Threat actors are carrying out cyberattacks targeting internet-connected operational technology (OT) across multiple critical infrastructure sectors. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian APTs Target 5,219 Exposed Rockwell PLCs in U.S. Critical Infrastructure Censys researchers identified 5,219 Rockwell Automation PLCs exposed to the internet, primarily located in the U.S. These devices are being targeted by Iranian-affiliated advanced persistent threat (APT) actors, as warned by U.S. agencies including the FBI, CISA, and NSA on April 7, 2026. The threat actors are exploiting vulnerabilities in internet-connected operational technology (OT) systems across various critical infrastructure sectors. This follows a previous campaign in November 2023 that compromised at least 75 Unitronics PLCs in U.S. water and wastewater facilities. Security experts are urging immediate action to secure or disconnect these vulnerable devices to mitigate potential attacks. The ongoing threat highlights the increasing risk to critical infrastructure from state-sponsored cyber operations. 3 sources 78

Extracted Entities

Platforms (1)

Rockwell Automation PLCs