Rockwell PLC Exposure Raises Alarm Over Iranian Cyber Threats

The growing exposure of Rockwell Automation PLCs has raised serious concerns across the cybersecurity landscape, especially as Iranian-linked threat groups intensify their targeting of industrial systems. A recent joint advisory from U.S. defense and cybersecurity agencies highlights how these attackers are actively probing programmable logic controllers that play a crucial role in managing essential infrastructure such as water systems and energy grids. What makes the situation particularly alarming is that more than 5,200 of these devices are currently accessible over the public internet, significantly increasing the risk of unauthorized access and disruption.

Much of this exposure is concentrated in the United States, which accounts for nearly three-quarters of the affected devices. A significant number of these PLCs are connected through cellular networks like Verizon Business and AT&T Mobility, indicating that they are deployed in remote or field environments. These setups, often designed for convenience and accessibility, have unintentionally created entry points for attackers by leaving critical systems directly reachable online without adequate protection.

Further investigation into the attacker infrastructure reveals a surprisingly centralized operation. Rather than multiple independent systems, researchers found that several malicious IP addresses traced back to a single Windows engineering workstation. This machine appears to be equipped with legitimate Rockwell engineering tools, effectively turning it into a powerful platform for launching attacks. By identifying a unique remote desktop certificate associated with this system, analysts uncovered additional IP addresses that were not included in the original government advisory, exposing gaps in the initial threat assessment. Another identified server, briefly used in Romania, functioned as a disposable staging point, suggesting a calculated and methodical approach by the attackers.