4,400+ Rockwell PLCs Exposed Online — 22 Found in Cities Hit by Water Utility Cyberattacks: Exposure Discovery, Detection, and Hardening Guide

On August 3, Forescout researchers completed an internet-wide scan and counted 4,407 Rockwell Automation programmable logic controllers (PLCs) directly exposed to the public internet worldwide — 2,844 of them in the United States. Of those, 22 exposed Rockwell controllers were identified in cities that had recently been hit by cyberattacks targeting US water utilities. Nineteen of those 22 devices shared the same mobile carrier network, suggesting a common pattern: PLCs reachable through consumer or industrial cellular gateways provisioned for remote access.

Forescout was careful to note it could not confirm any of these devices were compromised. That caveat should not provide comfort. An internet-reachable PLC is not a hypothetical risk — it is a precondition for the exact class of intrusion that has repeatedly hit the water and wastewater sector. You do not need a zero-day when the controller answers unauthenticated CIP (Common Industrial Protocol) requests from anyone who finds it on Shodan.

This finding lands at a moment when US water utilities are under sustained pressure from both nation-state actors (including groups CISA and the EPA have publicly attributed to Iranian and Russian interests) and opportunistic hacktivists who treat exposed HMIs and PLCs as low-hanging targets. The lesson from Forescout's scan is simple and uncomfortable: a meaningful fraction of the installed Rockwell base is one port scan away from direct manipulation of physical process logic.

Technical Analysis

What "exposed" actually means for a Rockwell PLC

Rockwell's controller families — ControlLogix, CompactLogix, MicroLogix, FlexLogix, GuardLogix, and the Micro800 line — communicate primarily over EtherNet/IP, which rides on:

• TCP/UDP 44818 — EtherNet/IP explicit messaging and encapsulation (the protocol Forescout-style internet scans most commonly fingerprint)
• UDP 2222 — EtherNet/IP implicit (I/O) messaging, typically only relevant inside a control zone
• TCP 80 / 443 — the embedded web server on many 1756-EN2T, 1756-EN3TR, and 5370-series modules, used for diagnostics and module status pages
• TCP 21 — FTP, historically enabled on older ControlLogix/CompactLogix firmware for firmware transfers

When Forescout counts 4,407 "exposed Rockwell controllers," it is enumerating devices that answer on one or more of these services from an arbitrary internet source. Critically, EtherNet/IP as implemented on these devices has no native authentication or encryption. Unless the controller is running firmware with CIP Security (TLS/DTLS-based) configured — rare in brownfield water plants — any host that can reach port 44818 can, at minimum:

1. Enumerate the controller: vendor, product name, serial number, firmware revision, slot layout — everything needed for tailored follow-on attacks.
2. Read and write tags, including tags that map to physical outputs (pump states, valve positions, chemical dosing setpoints).
3. Upload or download the controller program (ladder logic / structured text), altering process behavior persistently.
4. Issue mode-change requests (e.g., forcing the controller from RUN to PROGRAM), halting the physical process.

No memory corruption, no exploit chain, no CVE required. The exposure itself is the vulnerability. This is why no CVE appears in Forescout's reporting — the risk is architectural, not a patchable bug.

Why the cellular carrier correlation matters

The detail that 19 of the 22 water-sector PLCs sat behind the same mobile carrier network is operationally significant. It almost certainly reflects a common deployment pattern in small and mid-size water utilities: a cellular router (industrial LTE gateways from vendors like Sierra Wireless, Cradlepoint, Digi, or Teltonika) bridging remote lift stations, wells, and booster pumps back to the utility. These gateways are frequently:

• Provisioned with publicly routable carrier IPs rather than private APNs
• Configured with inbound port forwarding (44818, 80, 502, 5900/VNC) for "vendor remote access"
• Managed via cloud dashboards with weak or shared credentials
• Running firmware that is years out of date

The attack chain defenders should model is not "scan Shodan, exploit PLC" — it is: discover cellular gateway → compromise gateway (default creds, unpatched router vuln, or carrier IP scanning) → pivot to the isolated-seeming PLC behind it. The gateway is the ingress; the PLC is the impact.

Exploitation status

• Confirmed exploitation of these specific 4,407 devices: none. Forescout explicitly stated it could not confirm compromise.
• Confirmed hostile interest in exposed US water sector ICS: yes. CISA, the FBI, and the EPA have issued multiple joint advisories on intrusions into US water and wastewater systems, including manipulation of HMIs at small utilities.
• CISA KEV: No new KEV entry corresponds to this scan — because, again, this is an exposure problem, not a software defect. However, multiple historical Rockwell and cellular-gateway vulnerabilities remain in KEV and are routinely scanned for against this exact device population.

Treat the exploitation status as: massively elevated target surface with active, documented adversary interest in the sector.

Detection & Response

The honest reality of OT detection: you will not get endpoint telemetry from a ControlLogix chassis. Your visibility comes from (a) the engineering workstations and HMIs adjacent to the PLCs, (b) network inspection at zone boundaries (Purdue Level 2/3 and 3.5), and (c) your perimeter firewalls and cellular gateway logs forwarded into your SIEM. The detections below target those vantage points and are tuned to fire only on behavior that has no legitimate business reason in a properly segmented environment.

---
title: Internet-Sourced Connection to EtherNet/IP PLC Port
description: Detects inbound network connections to TCP/UDP 44818 (EtherNet/IP) from source addresses outside RFC1918 space. Any internet-sourced session to an industrial controller is high-fidelity malicious or misconfigured.
id: 6f2a1c94-3b7d-4e58-9a21-c4d5e6f70819
status: experimental
references:
  - https://thehackernews.com/2026/08/over-4400-rockwell-plcs-exposed-online.html
  - https://attack.mitre.org/techniques/T0883/
  - https://attack.mitre.org/techniques/T0886/
author: Security Arsenal
date: 2026/08/03
tags:
  - attack.initial_access
  - attack.t0883
  - attack.t0886
  - attack.t1190
logsource:
  category: firewall
detection:
  selection:
    dst_port: 44818
    action: allowed
  filter_rfc1918_dst:
    dst_ip|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
  condition: selection and filter_rfc1918_dst
falsepositives:
  - Misconfigured NAT/port-forward rules exposing OT assets to the internet (this IS the finding to investigate, not a false positive)
  - Cellular gateway bridges with public carrier IPs forwarding to controllers
level: critical
---
title: Engineering Software Execution on Non-Engineering Host
description: Detects execution of Rockwell engineering and communications software (RSLinx, Studio 5000 Logix Designer, RSLogix, FactoryTalk View) from user accounts or paths inconsistent with a dedicated engineering workstation. A common post-compromise step is adversaries installing or invoking these tools to enumerate and manipulate PLCs.
id: 9c4e7d12-8a3f-4b65-91d8-2e7f3a5c6094
status: experimental
references:
  - https://thehackernews.com/2026/08/over-4400-rockwell-plcs-exposed-online.html
  - https://attack.mitre.org/techniques/T0807/
  - https://attack.mitre.org/techniques/T0855/
author: Security Arsenal
date: 2026/08/03
tags:
  - attack.lateral_movement
  - attack.t0807
  - attack.t0855
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\RSLinx.exe'
      - '\RSLinxNG.exe'
      - '\RSLogix.exe'
      - '\RSLogix5000.exe'
      - '\FTViewSE.exe'
  filter_known_paths:
    Image|startswith:
      - 'C:\Program Files (x86)\Rockwell Software\'
      - 'C:\Program Files\Rockwell Automation\'
  condition: selection_img and not filter_known_paths
falsepositives:
  - Engineering tools legitimately installed outside default paths (tune per-asset baseline of approved EWS hosts)
  - Maintenance laptops used by integrators — scope by Computer/hostname allowlist of authorized engineering workstations
level: high

Tuning note on Rule 2: the highest-value deployment of this rule is per-host scoping — build an allowlist of your authorized engineering workstations (EWS) and alert on any execution of Rockwell tooling off that list. An attacker who gains an IT foothold and reaches for RSLinx to browse the control network is one of the most reliable behavioral signals in ICS IR.

KQL — Microsoft Sentinel / Defender

This query assumes firewall and cellular-gateway logs are ingested via CEF/Syslog into CommonSecurityLog. It hunts for internet-sourced sessions reaching EtherNet/IP and Modbus ports on your OT assets — the exact exposure class Forescout measured.

// Hunt: internet-sourced connections to ICS protocol ports (EtherNet/IP 44818, 2222; Modbus 502; legacy PLC FTP 21)
// Requires firewall / industrial cellular gateway logs ingested via CEF into CommonSecurityLog
let ICS_Ports = dynamic([44818, 2222, 502, 21, 5900]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (ICS_Ports)
| where DeviceAction in~ ("allow", "allowed", "accept", "permit")
// Exclude private source space — only flag sessions originating from public IPs
| where not(ipv4_is_private(SourceIP))
| summarize FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated),
            SessionCount = count(),
            Sources = make_set(SourceIP, 25),
            Firewalls = make_set(DeviceName, 10)
    by DestinationIP, DestinationPort, Protocol
| sort by SessionCount desc

Companion query for the endpoint side — engineering tooling on unexpected hosts via Defender for Endpoint:

// Hunt: Rockwell engineering/communications software executing outside approved engineering workstations
let ApprovedEWS = dynamic(["EWS-01", "EWS-02"]);  // Replace with your authorized EWS hostnames
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName in~ ("RSLinx.exe", "RSLinxNG.exe", "RSLogix.exe", "RSLogix5000.exe", "FTViewSE.exe")
| where DeviceName !in~ (ApprovedEWS)
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated desc

Velociraptor VQL

Use this on IT-side Windows assets (jump hosts, HMIs running Windows, historian servers) to identify live EtherNet/IP sessions and unexpected Rockwell tooling — useful both for hunting and for rapidly scoping an incident where a cellular gateway compromise is suspected.

-- Hunt: active EtherNet/IP (44818/2222) network sessions and Rockwell engineering tooling processes
-- Deploy across HMI, historian, jump host, and server collections in the DMZ and Level 3
SELECT Name AS Process,
       Pid,
       Address AS LocalAddress,
       RAddress AS RemoteAddress,
       Status
FROM netstat()
WHERE Address =~ ':44818'
   OR RAddress =~ ':44818'
   OR RAddress =~ ':2222'
   OR Name =~ '(?i)rslinx|rslogix|ftview'

-- Hunt: Rockwell engineering software present on systems outside the approved EWS list
SELECT Name,
       Pid,
       Exe,
       CommandLine,
       Username,
       CreateTime
FROM pslist()
WHERE Exe =~ '(?i)rockwell|rslinx|rslogix|factorytalk'
  AND NOT Exe =~ '(?i)program files.?(x86)?.rockwell'

Exposure Audit & Hardening Script (Bash)

Run this from a hardened management host with written authorization and OT change-window approval. The nmap probes below are single-packet service checks — safe on modern Rockwell firmware, but per standard OT practice, throttle the rate and run against a validated device inventory first. Never run aggressive (-A, -sV --script) scans against production controllers.

#!/bin/bash
# rockwell-exposure-audit.sh — identify exposed EtherNet/IP services and audit perimeter for OT leakage
# Run from a management/jump host. AUTHORIZED USE ONLY.

OT_SUBNETS="10.10.0.0/16 172.20.0.0/16"          # <-- your OT VLANs/subnets
EDGE_FW="192.168.1.1"                             # <-- perimeter firewall management IP
OUTPUT="rockwell_exposure_$(date +%Y%m%d).txt"

echo "=== [1] EtherNet/IP service discovery (44818/TCP+UDP) — gentle timing ===" | tee "$OUTPUT"
for SUBNET in $OT_SUBNETS; do
  nmap -Pn -n -T2 --max-rate 20 -p 44818,2222,502,21,80,443 "$SUBNET" \
    --open -oG - | grep -E "Ports: .*open" | tee -a "$OUTPUT"
done

echo "" | tee -a "$OUTPUT"
echo "=== [2] NAT / port-forward audit on edge firewall — any rule landing on 44818 is CRITICAL ===" | tee -a "$OUTPUT"
iptables -t nat -L -n -v --line-numbers 2>/dev/null | grep -Ei '44818|2222|502|dpt:21 ' | tee -a "$OUTPUT"
iptables -L FORWARD -n -v --line-numbers 2>/dev/null | grep -Ei '44818|2222|502' | tee -a "$OUTPUT"

echo "" | tee -a "$OUTPUT"
echo "=== [3] Cellular gateway audit — enumerate public IPs on known gateway interfaces ===" | tee -a "$OUTPUT"
for IFACE in $(ip -o link show | awk -F': ' '{print $2}' | grep -Ei 'wwan|usb|ppp|lte'); do
  ip addr show "$IFACE" | grep 'inet ' | awk '{print $2}' | tee -a "$OUTPUT"
done

echo "" | tee -a "$OUTPUT"
echo "=== [4] Public exposure check via Shodan CLI (requires API key) ===" | tee -a "$OUTPUT"
if command -v shodan >/dev/null 2>&1; then
  for SUBNET in $OT_SUBNETS; do
    shodan search --fields ip_str,port,product "net:$SUBNET port:44818" 2>/dev/null | tee -a "$OUTPUT"
  done
else
  echo "shodan CLI not installed — manually query: port:44818 product:Rockwell against your public ranges" | tee -a "$OUTPUT"
fi

echo "" | tee -a "$OUTPUT"
echo "=== AUDIT COMPLETE — review $OUTPUT. Any 44818 result reachable from a non-RFC1918 source = immediate remediation ticket. ==="

Remediation

1. Eliminate direct internet exposure — this week, not this quarter. Every Rockwell controller answering on 44818 from the public internet gets moved behind a firewall with default-deny inbound policy. If the device is reachable because of a NAT port-forward or a cellular gateway bridge, remove the forward. CISA's guidance on internet-exposed ICS (see CISA ICS advisories at https://www.cisa.gov/news-events/ics-advisories) is unambiguous: control system devices must not be directly internet-accessible.

2. Fix the remote access pattern that caused this. The 19-of-22 single-carrier correlation tells you exactly how these utilities got exposed. Replace public-IP cellular bridging with:

• Private APNs from your carrier so gateway IPs are non-routable
• Outbound-only VPN tunnels (gateway initiates to your headend; nothing inbound is ever permitted)
• A brokered remote access solution with MFA and session recording for vendor maintenance, rather than always-on port forwards

3. Segment per IEC 62443 / Purdue model. PLCs belong at Level 1/2 behind a Level 3.5 industrial DMZ. No path from the corporate LAN — let alone the internet — to a controller without traversing an inspected boundary. Enforce conduits: only approved EWS hosts and SCADA servers may initiate 44818 to the control zone.

4. Harden the controllers themselves.

• Upgrade firmware per Rockwell's security advisories (https://www.rockwellautomation.com/en-us/company/news/security.html) — older ControlLogix/CompactLogix firmware predates key security fixes
• Disable unused services: FTP, the embedded web server, and SNMP if not operationally required
• Where hardware supports it, evaluate CIP Security (TLS/DTLS) for new deployments
• Set the physical keyswitch to RUN (not REM) so remote mode changes require physical access
• Enable controller change detection / forensic logging features where firmware supports them

5. Inventory and continuously monitor the attack surface. Forescout found these devices with an internet scan — so can every adversary on earth, and so can you. Stand up external attack surface monitoring (Shodan/Censys queries against your ASN and public ranges, alerting on new ICS protocol fingerprints) and treat any new 44818/502 fingerprint on your IP space as a P1 incident.

6. Water utilities: lean on sector resources. EPA and CISA maintain water-sector-specific guidance, no-cost vulnerability scanning (CISA's Cyber Hygiene services), and tabletop exercise support. If you are a small utility running Rockwell gear over cellular — the exact demographic this story describes — enroll. This population is being actively targeted precisely because it is under-resourced.

Timeline guidance: perimeter exposure elimination within 7 days for anything answering from the internet; cellular architecture rework within 30 days; segmentation and firmware modernization as a funded program within two quarters.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub