Iranian APT alert: 5,219 Rockwell PLCs exposed online

Gbhackers •Mayura Kathir • April 10, 2026

Censys has warned that more than 5,000 Rockwell Automation/Allen-Bradley PLCs are currently exposed to the internet as Iranian-affiliated APT actors actively target these devices across U.S. critical infrastructure. The same operators were previously associated with a November 2023 campaign that compromised at least 75 Unitronics PLCs in U.S. water and wastewater facilities, showing a continuing […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Iranian APTs Target 5,219 Exposed Rockwell PLCs in U.S. Critical Infrastructure Censys researchers identified 5,219 Rockwell Automation PLCs exposed to the internet, primarily located in the U.S. These devices are being targeted by Iranian-affiliated advanced persistent threat (APT) actors, as warned by U.S. agencies including the FBI, CISA, and NSA on April 7, 2026. The threat actors are exploiting vulnerabilities in internet-connected operational technology (OT) systems across various critical infrastructure sectors. This follows a previous campaign in November 2023 that compromised at least 75 Unitronics PLCs in U.S. water and wastewater facilities. Security experts are urging immediate action to secure or disconnect these vulnerable devices to mitigate potential attacks. The ongoing threat highlights the increasing risk to critical infrastructure from state-sponsored cyber operations. 3 sources 78

Extracted Entities

Companies (1)

Unitronics