Cyberattack on the Sun: Threat Actors Manipulate Solar Panel Systems; Agentic AI Increases the Risk

This report describes observed large-scale scanning and exploitation attempts against Modbus-enabled solar string monitoring boxes, explaining that the Modbus protocol (commonly exposed on TCP/502) lacks authentication and encryption, enabling attackers using common tools or AI automation to read registers and issue control commands (e.g., 0xAC00 = SWITCH OFF) to disrupt solar production; the report outlines attacker tools and techniques and recommends network segmentation, monitoring, and closing exposed ports.