Skip to content
NOGTechnologien UG
DE EN
Start a project
OT security · Vulnerability6 min readNOG Technologien editorial team

PLCs on the internet: five immediate steps after the 2026 attacks

Since April, US agencies have been warning about targeted attacks on internet-reachable controllers. What is behind it and what you can implement within a week.

The situation

On 7 April 2026, the FBI, CISA, NSA, EPA, DOE and US Cyber Command published a joint warning. Attackers targeted internet-exposed PLCs, mainly Rockwell Automation/Allen-Bradley. They altered project files and manipulated what HMI and SCADA screens displayed. Later reports also mention Schneider Electric Modicon M340 and Siemens S7-1200.

Five immediate steps

  1. Check the outside view: which ports on your public IP addresses answer? Industrial protocols such as 102 (S7), 502 (Modbus) or 44818 (EtherNet/IP) never belong on the internet.
  2. Consolidate remote access: one entry point via VPN or jump host with multi-factor login. Switch off direct port forwards.
  3. Enable write protection: many controllers have protection levels or a mode switch. Use them.
  4. Back up project files: a current, verified backup of every PLC program, stored offline.
  5. Detect changes: a passive sensor reports write access from unknown hosts immediately.
Check yourselfOur OT port reference lists the default ports of all common industrial protocols.

The underestimated weak spot

Many of this year’s advisories do not concern the controller itself but the software around it: remote maintenance clients, firmware tools and engineering workstations. Whoever controls the workstation needs no flaw in the PLC. Treat engineering computers like servers: own zone, no email, no web browsing.

SourcesSecurityWeek, 07.04.2026CISA ICS AdvisoriesIndustrial Cyber: OT-ISAC advisory

This article is for general information and is not legal advice.

More articles

Article7 min

CRA reporting: what manufacturers must do since 11 September

The Cyber Resilience Act only fully applies from December 2027. Its reporting duties are already in force, including for products sold long ago. An overview for machine builders and device makers.
Article6 min

Fridges as a target: what the Danfoss incident teaches about legacy devices

Hundreds of supermarkets, spoiled goods and a vendor pointing to outdated firmware. The attack of 12 October shows a problem hidden in almost every plant.
Article5 min

FortiBleed: why firewall credentials put the whole plant at risk

Over 86,000 compromised FortiGate devices without a new vulnerability. The campaign shows how much depends on a single password.

NOG Contact · free first call

Let’s talk
about your
plant.

Tell us briefly what you are planning. We get back to you within two working days, on site if you prefer.

Start a project