The Global Surge in Modbus/TCP Probes Targeting Our Physical World

Between September and November 2025, Cato Networks observed a widespread campaign probing and interacting with internet-facing PLCs via Modbus/TCP across 70 countries and over 14,000 targets; actors used a scripted two-step sequence (fingerprinting via function 0x2B/0x0E and targeted register reads) and conducted significant read and write activity—one source issued 3,240 write requests—demonstrating a realistic risk of remote manipulation of physical processes and prompting recommendations to isolate Modbus from the public internet.