TLDR Tech / InfoSec
Global Campaign Discovered with Modbus PLCs Targeted and China-Geolocated Infrastructure Observed
Cato Networks documented a three-month global campaign (September to November 2025) hitting 14,426 internet-exposed Modbus/TCP PLCs across 70 countries, with manufacturing (18%) leading the sector breakdown and the US, France, and Japan accounting for 61% of targeted IPs. Activity progressed from automated Read Holding Register (0x03) reconnaissance (~235.5K requests from 233 IPs) through scripted fingerprint-then-read playbooks (0x2B/0x0E paired with reads at 0xB414) to higher-impact behaviors including DoS-style bulk reads of 124 registers (one source generated 158.1K reads against a single target), 3,240 Write Multiple Registers (0x10) attempts from one IP starting at 0x0BB8, and rare expanded device-identification (0200) probes from six China-geolocated sources flagged as higher-intent infrastructure. Defenders should keep Modbus off the public internet entirely, enforce OT/IT segmentation with strict source allowlisting for any required reachability, and block unsolicited inbound 0x10 writes by default to prevent register-level manipulation of physical processes.
Read the full story