Key Findings on OT Exposure and Geopolitical Risks
Network Threat Detection identified specific vulnerabilities in the current industrial landscape:
-
Global Exposure: 5,219 Rockwell/Allen-Bradley hosts are directly accessible via the public internet.
-
U.S. Concentration: 74.6% (3,891 hosts) of these exposed devices are located within the United States.
-
Targeted Sectors: CISA has prioritized Government Services, Water & Wastewater Systems, and Energy as high-risk sectors.
-
Critical Ports: Attackers are actively probing five OT-related ports: 44818, 2222, 102, 22, and 502.
"Geopolitical cyber campaigns succeed because industrial environments remain reachable and weakly segmented," stated a founder of Network Threat Detection. "Defenders require earlier visibility into unusual protocol traffic before system manipulation leads to operational downtime."
Escalating Ransomware Trends in Industrial Environments
The 2025 OT Cybersecurity Year in Review by Dragos highlights a worsening threat landscape:
-
Attack Surge: Industrial ransomware attacks increased by 87% in 2024, totaling 1,693 incidents.
-
Operational Impact: 75% of OT ransomware cases caused partial shutdowns, while 25% resulted in complete operational cessation.
-
Group Activity: In March 2026 alone, 672 ransomware incidents were reported globally, with 40% attributed to only three threat groups.
Network Threat Detection emphasizes that attackers frequently use legitimate vendor engineering tools. This tactic allows them to blend in with normal administrative traffic, making protocol monitoring as essential as traditional exploit detection.
Methodology
The analysis by Network Threat Detection integrates real-time threat modeling data with intelligence from CISA, Censys, Dragos, Check Point Research, and IBM.
Find the full study of Iran-linked PLC attacks available on our website.
FAQ
How many Rockwell/Allen-Bradley hosts are exposed to the internet?
Network Threat Detection identified 5,219 exposed hosts globally, with nearly 75% located in the United States.
Which OT ports are currently being targeted by Iran-linked actors?
According to CISA Advisory AA26-097A, the targeted ports are 44818, 2222, 102, 22, and 502.
What is the primary cause of OT cyber campaign success?
Network Threat Detection attributes success to internet-facing devices, weak network segmentation, and insufficient protocol monitoring rather than advanced exploit kits.
What percentage of OT ransomware attacks result in full shutdowns?
Data shows that 25% of OT-related ransomware incidents cause full operational shutdowns.
About Network Threat Detection
Network Threat Detection provides a real-time threat modeling and risk-intelligence platform that helps organizations map exposure and strengthen proactive cyber defense. The company was founded by cybersecurity experts with decades of combined experience in OT/ICS environments.
Media Contact
Company Name: Network Threat Detection
Contact Person: Media Relations
Email: Send Email
Phone: +1 760-520-2304
Address:4733 Fincham Road
City: San Diego
State: California 92111
Country: United States
Website: www.networkthreatdetection.com
