Loading story…
Industrial and building-automation environments continue to expose operational technology (OT) services directly to the public internet, increasing the likelihood of unauthorized access and disruption. An Intelligence-Driven Active Defense Report 2026 cited by Palo Alto Networks/Siemens/Idaho National Laboratory data indicates internet exposure is growing sharply, with Cortex Xpanse reporting 110M+ observations of exposed OT devices in 2024 and fingerprinting 19.6M unique OT devices/services across 1.77M IPv4 addresses; the highest concentrations were observed in the US, China, and Germany. Frequently observed exposed products included Tridium Niagara, Linear eMerge, and Saia PCD Web Server, and common exposure points included standard web ports TCP/443 and TCP/80 alongside OT/building-automation-associated ports such as TCP/502, UDP/47808, and Niagara-related ports like TCP/4911 and TCP/5011.
Similar internet-exposure risk was observed in healthcare, where Rapid7 Labs reported 30+ UK-based systems responding to DICOM requests over TCP/104 (the default medical imaging port) from the public internet. Rapid7 stated it used Project Sonar to validate service responsiveness only and did not attempt to access records, but warned that externally reachable DICOM services—especially without VPN restriction or encryption—are readily discoverable via routine scanning and were not designed for hostile networks. Prior research cited in the report indicates misconfigured or poorly controlled PACS/DICOM deployments can leak sensitive metadata (including patient identifiers) and may be susceptible to data reconstruction or modification, creating both cybersecurity and patient safety risk.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
A global scan found 311 Modbus responses on port 502, which researchers filtered down to 179 likely real internet-exposed ICS devices across multiple countries, with the United States hosting the most. Some exposed systems appeared linked to sensitive environments including a national railway network and national power grids in Europe and Asia, highlighting risks from Modbus's lack of authentication and encryption.
A report cited by Palo Alto Networks, Siemens, and Idaho National Laboratory said internet exposure of OT systems continues to grow, with remote access portals, building automation servers, and other OT services reachable on public IP space. The report also highlighted long precursor phases before attacks and promoted earlier detection and OT-SOC maturity improvements.
Rapid7 Labs reported that, at the time of observation, more than 30 UK-based systems were responding to DICOM requests over Port 104 from the public internet. It also observed additional externally reachable PACS-related systems over web ports such as 80 and 443, confirming service responsiveness without attempting to access records or exploit the systems.
Trend Micro's TrendAI analysis, based on Shodan data from November to December 2025, identified 3,627 publicly accessible DICOM servers across more than 100 countries, with about one-third located in the United States. The report said most lacked basic protections, with minimal TLS use, widespread acceptance of connections without AE Title validation, and exposure to several known vulnerabilities.
According to Palo Alto Networks, Cortex Xpanse observed more than 110 million instances of exposed OT devices in 2024, identifying 19.6 million unique OT devices and services across 1.77 million IPv4 addresses. The highest concentrations were reported in the United States, China, and Germany.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
5 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourcehelpnetsecurity.com
Open sourcerapid7.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and industry reporting warns that operational technology and industrial control systems remain dangerously exposed through weak remote access, poor segmentation, and internet-facing devices, giving both state-backed and criminal actors paths into critical infrastructure. A joint **CISA/NSA** advisory said adversaries routinely exploit legacy OT environments, public system information, and insecure remote connections to move from reconnaissance to manipulation of physical processes, while a separate **CISA/FBI** alert tied Chinese state-sponsored intrusions to U.S. natural gas pipeline operators and said the actors stole SCADA and ICS information to build capabilities for future disruption. Recent exposure research also found **6,300** internet-reachable industrial-control and building-automation devices near U.S. data centers, including **BACnet**, **Fox/Niagara**, **Modbus**, and Vertiv/Liebert systems that could affect cooling and power operations. The threat has already translated into real-world disruptive activity and increasingly specialized tooling. Dragos reported **FrostyGoop**, a Golang-based ICS malware that communicates over **Modbus TCP** and was likely used to disrupt heating services in Lviv, Ukraine, after attackers apparently entered through an internet-facing router and traversed poorly segmented networks. Other cited incidents and assessments include Israel’s thwarted attempt against water facilities, persistent Russian probing of U.S. power infrastructure, and leaked-document analysis describing a Russian capability designed to attack rail and petrochemical control systems through telecommunications access. Across the reporting, the common defensive priorities were to eliminate direct public exposure, harden and inventory remote access, enforce MFA, replace default credentials, patch supported systems, restrict engineering tools, and closely monitor OT network and protocol activity.
Aug 15, 2026
Researchers have observed a significant rise in the number of industrial control system (ICS) devices exposed to the internet, with the count increasing from approximately 160,000 at the start of 2024 to over 180,000 by the end of the year, and projections suggesting this figure could surpass 200,000 by the end of 2025. This trend has been highlighted by security firm Bitsight, which noted not only the growing number of exposed devices but also an uptick in operational technology (OT)-specific vulnerabilities. These vulnerabilities include remote code execution flaws, logic errors, and broken web authentication, some of which carry the highest possible severity ratings and offer attackers trivial exploit paths. The increase in exposed ICS/OT assets is attributed to the deployment of new devices with internet access, often configured with outdated or insecure protocols, minimal authentication, and insufficient network segmentation. This mismanagement of ICS/OT assets points to a broader issue in how organizations are securing critical infrastructure. The vulnerabilities present in these systems could allow attackers to disrupt essential services, manipulate industrial processes, or gain unauthorized access to sensitive environments. Security experts have warned that the lack of proper segmentation and the use of insecure protocols make these devices attractive targets for both cybercriminals and nation-state actors. The exposure of ICS devices is particularly concerning given their role in critical infrastructure sectors such as energy, water, and transportation. The U.S. government and cybersecurity agencies have issued advisories and called for improved security practices, including regular vulnerability assessments, implementation of strong authentication mechanisms, and network segmentation to reduce the attack surface. The growing attack surface created by these exposed devices increases the risk of large-scale cyberattacks that could have significant operational and safety impacts. Organizations are urged to prioritize the security of their ICS/OT environments by adopting best practices and leveraging available guidance from agencies such as CISA. The trend underscores the urgent need for a coordinated approach to securing critical infrastructure against evolving cyber threats. Failure to address these issues could result in severe disruptions to essential services and pose risks to public safety. The situation is further complicated by the rapid adoption of new technologies in industrial environments, which often outpaces the implementation of adequate security controls. As the number of internet-exposed ICS devices continues to rise, the potential for exploitation by malicious actors grows, making it imperative for organizations to act swiftly to mitigate these risks. The findings serve as a wake-up call for both private and public sector entities responsible for the security of critical infrastructure. Proactive measures, including continuous monitoring and timely patching of vulnerabilities, are essential to defend against the increasing threat landscape targeting ICS/OT systems.
Jun 29, 2026
The UK National Cyber Security Centre (NCSC) warned that multiple state and non-state actors are increasingly targeting operational-technology (OT) environments worldwide, including in the United Kingdom. The activity has caused limited real-world disruption and is concentrated on systems exposed to the public internet, including OT assets accessible through misconfiguration, legacy management connections, and unmanaged edge devices. The NCSC identified unsupported or end-of-life equipment, insecure industrial and management protocols, and unchanged default credentials as key exposure factors. It urged organisations to identify and remove public access to OT assets, segment OT from business and management networks, enforce strong authentication, maintain supported edge devices, protect controller logic from remote modification, continuously monitor connectivity, and test ransomware-resilient backup and recovery processes.
Aug 28, 2026