Rising Threats to Industrial Control Systems: Exposed Devices Pose Critical Infrastructure Risks A recent investigation by Cyble Research & Intelligence Labs reveals a sharp increase in vulnerabilities affecting industrial control systems (ICS), with disclosures nearly doubling between 2024 and 2025. The surge is driven by threat actors targeting energy, manufacturing, and utilities infrastructure, particularly through internet-exposed devices running legacy protocols like Modbus a decades-old standard lacking encryption and authentication. A scan of port 502, the default Modbus port, identified 179 exposed ICS devices worldwide, including critical infrastructure components. Among them: - A device linked to a national railway network, where ICS manages train routing and signaling. - Two devices tied to national power grids in Asia and Europe, responsible for monitoring consumption and electrical distribution. The United States had the highest number of exposed devices (57), followed by Sweden (22) and Turkey (19). While most devices (128) did not disclose vendor details, 54 revealed manufacturer information, with Schneider Electric (22), Data Electronics (14), and ABB Stotz-Kontakt (6) being the most prevalent. Exposed models included: - Schneider TM221CE40T (industrial automation logic controller) - Fastwel CPM713 (distributed I/O management) - eGauge Core EG4015 (energy meter and data logger) - Schneider BMXP342020 (industrial processor module) - A.Eberle PQI-DA-SMART (voltage and power logger) The risk is amplified by Modbus’s lack of authentication, allowing attackers to read and manipulate holding registers critical data points like temperature, voltage, and control states. Even minor unauthorized changes could disrupt operations. Researchers demonstrated this by mapping energy consumption from a live Schneider PowerLogic EM4880 installation using publicly available register lists. With the global ICS market projected to grow from $226.76 billion to $504.38 billion by 2033, the expansion of connected devices introduces new attack surfaces. Protocols like Modbus, DNP3, and BACnet designed for closed networks remain vulnerable when exposed online, requiring safeguards such as firewalls, VPNs, and network segmentation to mitigate risks. The findings underscore the growing threat to essential infrastructure, where even low-sophistication attackers could exploit unprotected systems.

The industrial behemoths Schneider Electric, werum.com, UCLA (http://ucla.edu), Abbie (http://abbvie.com), and Siemens Energy are among the five new MOVEit attacks victims listed on the dark web leak site for the Clop ransomware organization. Industrial Control Systems (ICS) are offered by Siemens Energy and Schneider Electric and are employed in crucial national infrastructures all over the world. Threat actors assert that by using the recently discovered MOVEit Transfer vulnerability CVE-2023-34362, they were able to breach 100 different businesses. Incentives are provided by the US government for intelligence that results in the capture, indictment, or location of threat actors.