No exploited vulnerability has been confirmed. Forescout notes the described effects, changed IP addresses and passwords on controllers that were already reachable, could be achieved without exploiting one. Forescout also reported that Braham described malware delivered over a wireless connection, which is a delivery method rather than a controller exploit. Neither the FBI nor CISA has published how the attackers located or first accessed the devices.

Forescout counted 4,407 internet-exposed devices responding on port 44818, the EtherNet/IP service used by Rockwell Automation controllers, on 3 August 2026. Of those, 2,844 were in the United States. That figure counts exposed devices, not confirmed victims or exploitable systems.

CISA's 30 July 2026 alert tells operators to disconnect programmable logic controllers from the internet and avoid direct remote access to them. Where remote administration is needed, it should run through a properly secured VPN or gateway device. CISA also advises enabling password protection, replacing default credentials, allowlisting known engineering workstations, and keeping a clean backup image of each controller

A firewall answers on a known address, which makes it discoverable and a potential entry point in its own right. Entropya's IEG Router applies Digital Camouflage so the equipment behind it returns nothing to a scan. It complements or replaces a perimeter device depending on the architecture.