Loading story…
Researchers have observed a significant rise in the number of industrial control system (ICS) devices exposed to the internet, with the count increasing from approximately 160,000 at the start of 2024 to over 180,000 by the end of the year, and projections suggesting this figure could surpass 200,000 by the end of 2025. This trend has been highlighted by security firm Bitsight, which noted not only the growing number of exposed devices but also an uptick in operational technology (OT)-specific vulnerabilities. These vulnerabilities include remote code execution flaws, logic errors, and broken web authentication, some of which carry the highest possible severity ratings and offer attackers trivial exploit paths. The increase in exposed ICS/OT assets is attributed to the deployment of new devices with internet access, often configured with outdated or insecure protocols, minimal authentication, and insufficient network segmentation. This mismanagement of ICS/OT assets points to a broader issue in how organizations are securing critical infrastructure. The vulnerabilities present in these systems could allow attackers to disrupt essential services, manipulate industrial processes, or gain unauthorized access to sensitive environments. Security experts have warned that the lack of proper segmentation and the use of insecure protocols make these devices attractive targets for both cybercriminals and nation-state actors. The exposure of ICS devices is particularly concerning given their role in critical infrastructure sectors such as energy, water, and transportation. The U.S. government and cybersecurity agencies have issued advisories and called for improved security practices, including regular vulnerability assessments, implementation of strong authentication mechanisms, and network segmentation to reduce the attack surface. The growing attack surface created by these exposed devices increases the risk of large-scale cyberattacks that could have significant operational and safety impacts. Organizations are urged to prioritize the security of their ICS/OT environments by adopting best practices and leveraging available guidance from agencies such as CISA. The trend underscores the urgent need for a coordinated approach to securing critical infrastructure against evolving cyber threats. Failure to address these issues could result in severe disruptions to essential services and pose risks to public safety. The situation is further complicated by the rapid adoption of new technologies in industrial environments, which often outpaces the implementation of adequate security controls. As the number of internet-exposed ICS devices continues to rise, the potential for exploitation by malicious actors grows, making it imperative for organizations to act swiftly to mitigate these risks. The findings serve as a wake-up call for both private and public sector entities responsible for the security of critical infrastructure. Proactive measures, including continuous monitoring and timely patching of vulnerabilities, are essential to defend against the increasing threat landscape targeting ICS/OT systems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SC Media reported that researchers observed an increase in internet-exposed industrial control systems devices. The reference does not provide further specifics on scope, vendors, or affected organizations.
CISA announced the release of one Industrial Control Systems advisory. No additional technical details or affected products are provided in the reference.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Industrial control systems (ICS) and critical infrastructure organizations are facing an escalating threat landscape due to the convergence of operational technology (OT) and information technology (IT), which has eroded traditional security boundaries. As ICS environments become increasingly interconnected with corporate IT networks, they are exposed to a broader array of sophisticated cyber threats, including those from nation-state actors. The consequences of a successful cyberattack on ICS can be severe, ranging from equipment failure and production halts to environmental disasters and threats to human safety. The Colonial Pipeline incident, which resulted from a single compromised password, demonstrated how a digital breach can disrupt physical operations and supply chains, affecting millions of people. In addition to direct attacks on ICS, critical infrastructure organizations must contend with the proliferation of unmonitored data across collaboration platforms such as SharePoint, Google Drive, Exchange, Gmail, Teams, Slack, and Box. This 'back-office clutter' creates a vast, largely ungoverned attack surface that is increasingly targeted by sophisticated adversaries. Sensitive documents, including CAD files, PDFs, and chat transcripts, are often left unclassified and unmonitored, making them attractive targets for cybercriminals. Security leaders have traditionally focused on patching and segmenting OT systems, but the rapid growth of data sprawl in enterprise collaboration tools now demands equal attention. The ease of spinning up new sites and channels for business operations has led to petabytes of data scattered across thousands of locations, often without adequate oversight. This situation is exacerbated by the fact that attackers can exploit these unmonitored environments to gain access to critical systems or sensitive information. The need for robust ICS cybersecurity is now a top priority, as the risks extend far beyond data loss to include operational disruption and public safety hazards. Organizations are urged to implement comprehensive monitoring, classification, and governance of both OT and IT environments to mitigate these risks. The evolving threat landscape requires a shift from traditional, static security measures to dynamic, intelligence-driven approaches that can adapt to new attack vectors. Failure to address these challenges could result in significant operational, financial, and reputational damage for industrial organizations. The integration of continuous monitoring and incident response capabilities is essential to detect and respond to threats in real time. As cyber threats continue to evolve, the security of ICS and the management of enterprise data sprawl must remain at the forefront of critical infrastructure protection strategies. The lessons from past incidents underscore the urgent need for a holistic approach to cybersecurity that encompasses both the physical and digital assets of industrial organizations.
Jun 29, 2026
Government and industry reporting warns that operational technology and industrial control systems remain dangerously exposed through weak remote access, poor segmentation, and internet-facing devices, giving both state-backed and criminal actors paths into critical infrastructure. A joint **CISA/NSA** advisory said adversaries routinely exploit legacy OT environments, public system information, and insecure remote connections to move from reconnaissance to manipulation of physical processes, while a separate **CISA/FBI** alert tied Chinese state-sponsored intrusions to U.S. natural gas pipeline operators and said the actors stole SCADA and ICS information to build capabilities for future disruption. Recent exposure research also found **6,300** internet-reachable industrial-control and building-automation devices near U.S. data centers, including **BACnet**, **Fox/Niagara**, **Modbus**, and Vertiv/Liebert systems that could affect cooling and power operations. The threat has already translated into real-world disruptive activity and increasingly specialized tooling. Dragos reported **FrostyGoop**, a Golang-based ICS malware that communicates over **Modbus TCP** and was likely used to disrupt heating services in Lviv, Ukraine, after attackers apparently entered through an internet-facing router and traversed poorly segmented networks. Other cited incidents and assessments include Israel’s thwarted attempt against water facilities, persistent Russian probing of U.S. power infrastructure, and leaked-document analysis describing a Russian capability designed to attack rail and petrochemical control systems through telecommunications access. Across the reporting, the common defensive priorities were to eliminate direct public exposure, harden and inventory remote access, enforce MFA, replace default credentials, patch supported systems, restrict engineering tools, and closely monitor OT network and protocol activity.
Aug 15, 2026
CISA released a coordinated set of advisories detailing critical vulnerabilities affecting a range of industrial control system (ICS) products from major vendors, including Inductive Automation, Schneider Electric, Mitsubishi Electric, Siemens, Rockwell Automation, and Axis Communications. The vulnerabilities span a variety of attack vectors, such as improper privilege management, deserialization of untrusted data, OS command injection, and flaws in network protocol implementations. Exploitation of these vulnerabilities could result in severe outcomes, including SYSTEM-level code execution, denial-of-service conditions, information tampering, information disclosure, authentication bypass, and remote code execution across affected ICS platforms. Vendors have issued patches and mitigation guidance for impacted products, urging organizations in critical infrastructure sectors to update their systems promptly. The advisories highlight the global deployment of these products in sectors such as manufacturing, energy, and commercial facilities, underscoring the potential for widespread impact if left unaddressed. CISA encourages administrators to review the technical details and apply recommended remediations to reduce the risk of exploitation and maintain operational resilience.
Jun 29, 2026