Team Cymru Reports Thousands of Internet-Exposed ICS Devices
Summary
Team Cymru says Scout data identified thousands of internet-exposed ICS device IPs in January 2026, led by Rockwell and Moxa. The article also recounts CERT-PL-attributed Dragonfly attacks on Hitachi and Moxa devices and Rockwell flaws CVE-2023-3595 and CVE-2023-3596.
Key points
- Team Cymru reports 6,653 Rockwell IPs (68.1%) and 1,532 Moxa IPs (15.7%) among targeted ICS devices tracked in January 2026.
- The United States accounted for 45.4% (1,269 unique IPs) in the article’s country breakdown.
- CERT-PL reportedly attributed attacks on Hitachi RTU560 devices to Dragonfly, involving default credentials and corrupted firmware that caused boot loops; the reported damage affected communications, not electricity generation.
- In the same reported campaign, attackers allegedly used default credentials on Moxa devices, then reset them, changed administrative passwords, and set their IP addresses to 127.0.0.1, disrupting visibility and control of connected equipment.
- Rockwell Automation and CISA disclosed CVE-2023-3595 and CVE-2023-3596 in ControlLogix communication modules; a described exploit capability could enable remote code execution, but the article says the discovery was not triggered by a breach.
- The article recommends keeping ICS devices off the public internet and describes using NetFlow-based monitoring to find exposed OT devices and support detection.
Article Details
- Publisher
- Team Cymru
- Report Period
- January 2026 exposure data; case studies include reported activity on 2025-12-29 and vulnerability disclosures from July 2023.
- Scope
- Three case studies on internet-exposed ICS/OT devices: Hitachi RTU560, Moxa NPort, and Rockwell Automation ControlLogix equipment.
- Sample Size
- Unique IP addresses of targeted ICS devices; the overall total is not reported.
- Key Statistics
- In January 2026, Rockwell Automation devices accounted for 68.1% of exposed devices (6,653 unique IPs), according to Team Cymru.
- In January 2026, Moxa devices accounted for 15.7% (1,532 unique IPs), according to Team Cymru.
- The United States accounted for 45.4% (1,269 unique IPs) of targeted devices in the January 2026 country data, according to Team Cymru.
- Recommendations
- Do not expose ICS devices directly to the public internet.
- Monitor sensitive OT environments non-disruptively using Netflow data.
- Discover and pinpoint internet-exposed ICS devices before adversaries do.
- Enrich intrusion detection systems with global intelligence to improve alert triage.
MITRE ATT&CK
T1078 · Valid AccountsCERT-PL reportedly said Dragonfly operators used unrotated default account credentials to access exposed device web interfaces.T1495 · Firmware CorruptionThe reported Hitachi RTU560 attack used corrupted ELF firmware files to trigger invalid instructions and an infinite boot loop.
CVE
CVE-2023-35952023, Rockwell Automation and CISA issued an urgent disclosure regarding critical vulnerabilities (CVE-2023-3595 and CVE-2023-3596) found within the 1756-EN2, EN3, and EN4 communication modules. These modules areCVE-2023-3596Automation and CISA issued an urgent disclosure regarding critical vulnerabilities (CVE-2023-3595 and CVE-2023-3596) found within the 1756-EN2, EN3, and EN4 communication modules. These modules are the translators of
Threat Actors
Berserk BearThe article identifies Berserk Bear as an alias of Dragonfly, which CERT-PL attributed to the reported campaign targeting the Polish power grid and ICS/OT devices.DragonflyCERT-PL attributed the reported campaign targeting the Polish power grid and ICS/OT devices to Dragonfly. The article says the US Justice Department links the group to the Russian FSB.Volt TyphoonThe article says Volt Typhoon is known to conduct reconnaissance on US water systems and compromise routers at electric utilities to establish access in preparation for potential future conflicts.
Malware
Vendors
Hitachi EnergySiemens (7.3%), Schneider Electric (4.5%), Hitachi Energy (4.2%), and Mitsubishi Electric (0.1%) make up the remainder of the chart. While their percentages are smaller relative to Rockwell and Moxa, hundreds of uniqueMitsubishi ElectricSiemens (7.3%), Schneider Electric (4.5%), Hitachi Energy (4.2%), and Mitsubishi Electric (0.1%) make up the remainder of the chart. While their percentages are smaller relative to Rockwell and Moxa, hundreds of uniqueMoxaFigure 1: Analysis of top five countries with Hitachi RTU560 device internet exposure via Team Cymru Scout.Case Study 2: Moxa Devices and the Denial-of-Service LockoutRockwell AutomationFigure 2: Analysis of top five countries with Moxa device internet exposure via Team Cymru Scout.Case Study 3: Rockwell Automation and the "TRISIS-Class" ThreatSchneider ElectricSiemens (7.3%), Schneider Electric (4.5%), Hitachi Energy (4.2%), and Mitsubishi Electric (0.1%) make up the remainder of the chart. While their percentages are smaller relative to Rockwell and Moxa, hundreds of uniqueSiemensSiemens (7.3%), Schneider Electric (4.5%), Hitachi Energy (4.2%), and Mitsubishi Electric (0.1%) make up the remainder of the chart. While their percentages are smaller relative to Rockwell and Moxa, hundreds of uniqueTeam CymruTeam Cymru works with defenders at critical national infrastructure (CNI) organizations around the world to discover and protect internet-exposed industrial control systems (ICS) devices, such as PLCs, RTUs, and SCADA
Products
1756-EN2urgent disclosure regarding critical vulnerabilities (CVE-2023-3595 and CVE-2023-3596) found within the 1756-EN2, EN3, and EN4 communication modules. These modules are the translators of the Allen-Bradley ControlLogixAllen-Bradley ControlLogixthe 1756-EN2, EN3, and EN4 communication modules. These modules are the translators of the Allen-Bradley ControlLogix platform, handling high-speed Ethernet/IP traffic across the backplane to other industrialHitachi RTU560The Hitachi RTU560 (formerly ABB) is a product that supports modern electrical grid stability, serving as a high-end, modular Remote Terminal Unit (RTU) for large-scale substation automation and transmission. However,Moxa NPortThe Moxa NPort device serves as a critical bridge in industrial environments, functioning as a secure serial-to-ethernet device server that allows legacy serial hardware, such as sensors, programmable logic controllers
Tools
Countries
PolandThe Computer Emergency Response Team of Poland (CERT-PL) recently reported on a disturbing campaign attributed to Dragonfly (aka Berserk Bear) to target the Polish power grid. Dragonfly is a threat group linked to theRussiaFigure 5. Number of exposed ICS devices per country detected in January 2026.Russia (4.3%), Ukraine (3.0%), and Taiwan (2.6%) all appear in the top 10. Seeing these specific nations on the list is a direct reflection ofTaiwan5. Number of exposed ICS devices per country detected in January 2026.Russia (4.3%), Ukraine (3.0%), and Taiwan (2.6%) all appear in the top 10. Seeing these specific nations on the list is a direct reflection ofUkraineFigure 5. Number of exposed ICS devices per country detected in January 2026.Russia (4.3%), Ukraine (3.0%), and Taiwan (2.6%) all appear in the top 10. Seeing these specific nations on the list is a direct reflection ofUnited Statesin Figure 5 highlights where the devices the adversaries are looking for are primarily located. The United States accounts for nearly half of all targeted devices at 45.4% (1,269 unique IPs), which is a concern for
Industries
Critical infrastructurefor the US, due to state-aligned threat actors frequently engaging in pre-positioning within critical infrastructure.Industrial automationa massive 68.1% of the exposed devices (6,653 unique IPs). Rockwell is one of the world's largest industrial automation companies, heavily utilized in North America and globally. Because these devices are used to