Summary
- Forescout’s Vedere Labs found 4,000+ Rockwell Automation and Allen-Bradley industrial controllers exposed online via Shodan; 65% are in the United States.
- The FBI and EPA confirmed cyberattacks on water and wastewater utilities across at least 12 US states since late July, with Michigan, South Dakota and Georgia among the named states.
- Attackers targeted MicroLogix 1100 and 1400 PLCs, in at least one case locking utilities out by changing device IP addresses and passwords.
- 19 of 22 exposed controllers in recently attacked cities appear vulnerable to CVE-2017-16740, a remote code execution flaw disclosed in 2017.
- Forescout characterises the activity as opportunistic mass scanning rather than sophisticated targeted intrusion or zero-day exploitation.
The exposure picture
A scan conducted through the Shodan search engine by Forescout’s Vedere Labs on Monday identified more than 4,000 Rockwell Automation and Allen-Bradley industrial controllers directly accessible on the public internet. Of those, 2,844 — roughly 65 per cent — are located in the United States. The most common device family found was the MicroLogix 1400, accounting for half of all exposed units. The CompactLogix 1769 series made up a further 22 per cent, while MicroLogix 1100 and ControlLogix 5590 devices each represented around 8 per cent.
A federal advisory confirms the attacks are real
The research arrives in the wake of a joint advisory from the FBI and the Environmental Protection Agency confirming cyberattacks against water and wastewater utilities across at least 12 US states since 27 July. Michigan, South Dakota and Georgia have been publicly named among the affected states. Nine systems were compromised in Michigan alone, and a wastewater lift station was struck in South Dakota. The advisory specifically identified Rockwell Automation’s Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers as the targeted equipment.
What the attackers actually did
In at least one documented case, attackers gained remote access to controllers and changed their IP addresses and passwords, effectively cutting off the utility’s own visibility and control over the equipment. The advisory noted that attacks caused physical consequences including pressure loss and flooding. The method of access remains consistent with exploiting internet-exposed devices rather than any sophisticated intrusion chain. Several reports have linked the activity to Iranian actors, but Forescout has not attributed the attacks to any specific actor or group.
Opportunistic, not surgical
Sai Molige, senior manager of threat hunting at Forescout, described the pattern clearly: “The evidence supports opportunistic, at-scale exploitation of a known class of vulnerabilities affecting internet-exposed devices. The scale and speed of the activity are more consistent with mass scanning and enumeration than with zero-day exploitation, a months-long intrusion campaign, or custom malware.” That framing is important for risk assessment — these are not highly resourced, precisely targeted operations. They are the industrial equivalent of automated credential stuffing: volume-based, exploiting whatever is reachable.
A seven-year-old vulnerability still in play
When Forescout cross-referenced the exposed devices against the cities and municipalities recently affected by attacks, it found 22 controllers still sitting on the open internet. Of those, 19 appeared — based on firmware version — to be susceptible to CVE-2017-16740, a remote code execution vulnerability in MicroLogix 1400 devices disclosed in 2017. Exploitation requires Modbus TCP to be enabled, and Forescout could not confirm whether the affected systems had that feature active. Rockwell Automation has warned customers against placing controllers directly on the public internet since at least 2018.
Stale digital infrastructure compounds the risk
Beyond the controllers themselves, Forescout’s researchers examined associated digital infrastructure and found a pattern of neglect: expired certificates, remote-access web addresses left unrenewed for months or years, and what appear to be abandoned servers. In one case, a server has displayed nothing but a default Microsoft webpage since April 2019. Molige acknowledged the risk these assets represent while being measured about their role in the current incidents: “These stale services can increase the attack surface; however, we have not yet confirmed how the observed attacks occurred.”
The protocol gap
The exposed devices communicate via EtherNet/IP, an industrial protocol designed for communication between control equipment, engineering workstations and related systems. When the associated port is open to the public internet, external parties can identify devices and, depending on how they are configured, may be able to modify settings or write new configurations. This is not a novel attack surface — it is a well-understood exposure that has simply not been remediated at scale.
Why it matters
For CISOs with operational technology responsibilities — or whose organisations sit within critical infrastructure supply chains — this research is a direct prompt to audit internet-facing ICS and SCADA assets. The threat here is not sophisticated nation-state tradecraft requiring bespoke defences. It is systematic scanning for known-exposed, known-vulnerable devices. That means basic network hygiene — removing direct internet access to controllers, patching against disclosed CVEs, and decommissioning stale remote-access infrastructure — remains the primary control gap. The consequences of failure, as demonstrated by pressure loss and flooding at US utilities, are operational and physical, not just data-related. CISOs in any sector running similar OT environments should treat this as a peer-group incident with direct applicability to their own exposure.
What to do now
- Audit your OT environment for any Rockwell Automation or Allen-Bradley controllers — particularly MicroLogix 1100, MicroLogix 1400, CompactLogix 1769 and ControlLogix 5590 models — that are directly accessible on the public internet and remove that access.
- Check firmware versions on MicroLogix 1400 devices against CVE-2017-16740 and apply available patches; confirm whether Modbus TCP is enabled and disable it if not operationally required.
- Review the advisory from the FBI and EPA covering attacks on water and wastewater utilities since July for indicators and guidance specific to PLC-targeting activity.
- Conduct a sweep of associated digital infrastructure — SSL certificates, remote-access URLs, externally facing servers — and decommission or renew anything that is expired or abandoned.
- Follow Rockwell Automation’s published guidance against placing industrial controllers directly on public-facing networks, and implement network segmentation and firewall controls appropriate for OT environments.
