Iranian APTs Target 5,219 Exposed Rockwell PLCs in U.S. Critical Infrastructure

Iranian-affiliated APT actors are targeting 5,219 internet-exposed Rockwell Automation PLCs in the United States; U.S. agencies (FBI, CISA, NSA) issued an April 7, 2026 warning urging immediate remediation or disconnection of vulnerable OT devices, noting ongoing exploitation of internet-connected operational technology and referencing a November 2023 campaign that compromised at least 75 Unitronics PLCs in water/wastewater facilities.