Iranian APT alert: 5,219 Rockwell PLCs exposed online

Censys and U.S. agencies warn that Iranian-affiliated APT actors (linked to IRGC Cyber Electronic Command/CyberAv3ngers) are actively targeting internet-facing Rockwell/Allen‑Bradley PLCs using legitimate Rockwell tooling to access and modify PLC/HMI projects. Telemetry shows 5,219 exposed EtherNet/IP hosts (74.6% in the U.S.), numerous co-exposed services (VNC, Telnet, Modbus), and attacker infrastructure tied to specific IPs and certificates; agencies advise immediate isolation of PLCs from the internet, use of VPN/jump hosts, hardening of exposed services, and offline backups.