The IT Nerd

CloudSEK researchers have documented how artificial intelligence has fundamentally collapsed the barrier to targeting industrial control systems, compressing what once required weeks of specialist knowledge into a five-minute reconnaissance workflow. 

The findings come as the 28 February 2026 US-Israel strikes against Iran triggered the largest single-event activation of Iranian-aligned cyber actors ever documented, with over 60 hacktivist groups mobilising within hours – many without deep ICS expertise, but now equipped with AI tools that make that expertise unnecessary.

Key Findings

• CloudSEK identified 40,000+ internet-exposed US industrial control systems immediately discoverable using AI-assisted reconnaissance – and confirmed that a passive five-minute workflow using free tools can identify live devices, retrieve default credentials, map accessible interfaces, and enumerate CVEs without authenticating to or probing a single system.
• OpenAI confirmed in October 2024 that Iranian-affiliated actors (CyberAv3ngers) used ChatGPT to conduct ICS reconnaissance, querying default credentials for industrial devices, generating Shodan search strings, and requesting automation scripts – one of the first documented use of a commercial LLM by a state-affiliated actor against critical infrastructure.
• More than 60 Iranian-aligned hacktivist groups mobilised within hours of the 28 February 2026 strikes. The death of Supreme Leader Khamenei disrupted IRGC command structures, removing the political constraints that historically governed Iranian cyber targeting. Proxy and hacktivist groups now operate without accountability for civilian harm.
• US government reporting confirms 75+ US ICS devices were compromised in campaigns linked to the same threat ecosystem, including 34+ in the Water and Wastewater sector. The 2023 Aliquippa water plant compromise – forced onto manual operations by a default password – is the documented template these groups are replicating.
• Internet exposure across OT and ICS environments is worsening: 35% year-on-year growth in exposed systems and a 160% surge in Unitronics port 20256 exposure, despite two years of CISA advisories following the Aliquippa attack (ReliaQuest, H1 2025).

Why This Matters

The real shift is not in malware sophistication. It is in speed, scale, and accessibility. AI is enabling less technically mature actors to perform ICS reconnaissance that once required years of specialist knowledge.

 In a conflict environment where over 60 groups are simultaneously activated and seeking accessible targets, AI compresses the cycle from intent to impact.

CloudSEK researchers reproduced the AI-assisted reconnaissance chain as a passive research exercise, mirroring the confirmed methodology. Following the same process, researchers identified multiple live instances of unauthenticated, internet-exposed ICS systems with direct operational impact potential. 

CloudSEK notes that the passive nature of this research, standard HTTP requests against publicly indexed systems, is indistinguishable from what a threat actor would perform.

The cyber fallout from the Iran-US conflict is not limited to advanced state-linked operators. Loosely aligned hacktivists and proxy actors can now use AI-assisted workflows to identify and prioritise exposed industrial assets in real time, increasing the risk of opportunistic disruption to water treatment, energy distribution, fuel management, and manufacturing operations.

The same 28 February window also saw OpenAI confirm a partnership with the US Department of Defense, triggering a 295% spike in ChatGPT app uninstalls (Sensor Tower via TechCrunch). As commercial AI platforms face governance pressure around military use, threat actors migrate to unconstrained alternatives. The safety guardrails that limited CyberAv3ngers on ChatGPT in 2024 are a floor, not a ceiling.

Immediate Defensive Priorities

CloudSEK recommends that organisations urgently:

• Remove ICS management interfaces from the public internet immediately and place them behind VPN. This single action eliminates the AI-assisted passive reconnaissance attack path entirely.
• Change default credentials on all deployed ICS devices. The Unitronics default password 1111 is in a vendor manual, in CISA Advisory AA23-335A, and in active use on internet-exposed devices today.
• Block industrial protocol ports at the perimeter: TCP 20256, 102, 502, 44818, 1911 and UDP 47808 have no legitimate reason to be directly internet-accessible.
• Audit all third-party remote access to OT environments. IT managed service providers with tools on OT networks are confirmed entry points for supply chain attacks.
   

CloudSEK’s findings are based on passive reconnaissance of publicly indexed information and exposed web interfaces, without logging into or actively probing any system.

You can read the research here: AI, the Iran-US Conflict, and the Threat to US Critical Infrastructure | CloudSEK

CloudSEK today released a threat landscape assessment warning that more than 60 hacker groups mobilised within hours of the February 28, 2026 Iran–US military escalation — and that tens of thousands of US industrial control systems remain directly reachable from the internet, many with no authentication beyond a factory-default password.

The report, “A Threat Actor Landscape Assessment of ICS/OT Targeting in the 2026 Iran–US Conflict,” identifies a two-tier threat ecosystem: nation-state APTs pre-positioned inside US networks for years, and a fast-expanding pool of state-backed hacktivist proxies that need nothing more than an exposed device and a motivation to cause national-headline disruption. 

CloudSEK’s report finds that the industrial attack surface remains exposed at scale. In the United States alone, researchers identified approximately 182.2K internet-exposed industrial and automation-related assets (including both live and historically observed systems). Many of these were found to be actively reachable and exposed without authentication.

The exposure is not limited to the U.S.: Israel recorded around 104.9K such assets, while the United Kingdom showed roughly 88.8K exposed assets. CloudSEK notes that these listings represent industrial or automation-related devices observed on the public internet, underscoring the scale of potential targeting during periods of geopolitical escalation. 

Key highlights from the report

• Rapid mobilization after escalation: CloudSEK observed a sharp rise in hacktivist and proxy activation following February 28, increasing the volume of actors scanning for high-visibility infrastructure targets.
• Exposure at scale across industrial protocols: The report identifies large volumes of internet-reachable industrial services in the US, across widely used ICS/OT and automation protocols and platforms — indicating that many operational environments remain discoverable from the public internet.
• Three primary routes from discovery to impact:
  1. Direct access to exposed industrial interfaces (often enabled by weak/default credentials)
  2. Phishing and compromise of OT-adjacent users and vendors (engineering workstations, operators, third-party access)
  3. Enterprise IT compromise followed by lateral movement into OT, allowing adversaries to pre-position access and activate during crisis windows
• Basic weaknesses continue to enable real-world compromise: The report underscores that industrial incidents often stem from long-standing issues — internet exposure, unsecured remote access, and default credentials — rather than rare, highly advanced exploits.
• Operational risk is physical by design: Unlike purely digital attacks, ICS/OT compromise can affect physical processes, making disruption potentially immediate and safety-relevant.

Why default access and exposed interfaces remain a critical risk

CloudSEK’s assessment notes that many industrial environments remain vulnerable because exposed devices and interfaces can be identified quickly through standard internet scanning. In such cases, attackers may not need to exploit software vulnerabilities — they only need to find an exposed system and gain access using weak or default authentication.

This dynamic becomes more dangerous during periods of escalation, when some actors prioritise visibility and disruption over stealth.

Recommended actions for operators and defenders

CloudSEK urges critical infrastructure owners and operators to prioritise immediate, practical defensive measures:

• Remove ICS/OT management interfaces from the public internet wherever possible; enforce VPN-only access for remote operations
• Eliminate default credentials and strengthen authentication on industrial devices and management consoles
• Restrict industrial protocol exposure at the perimeter and shut down unnecessary remote-access services
• Audit and limit third-party remote access into OT environments (MSPs/RMM tools, vendor pathways)
• Improve monitoring and logging in OT-adjacent environments to detect unauthorised access and lateral movement early