Exposed and vulnerable: Recent attacks highlight critical need to protect internet-exposed OT devices

Microsoft reports an increase in attacks since late 2023 against internet-exposed, poorly secured OT devices—including a November 2023 incident at the Aliquippa water plant attributed to IRGC-affiliated "CyberAv3ngers"—where exposed Unitronics PLC/HMI systems with default or weak credentials and open control ports were scanned, accessed, defaced, and used to disrupt a pressure regulation pump. The report details the common attacker methodology, cites CVE-2023-6448 for default credentials, documents wider campaign activity, and provides mitigation and detection recommendations such as eliminating direct internet exposure, patching, segmentation, and using Defender for IoT detections.