Censys finds 5,219 devices exposed to attacks by Iranian APTs, majority in U.S.
2026-04-12T02:51:52Z•f82627600a244b53483fefd2315bcd9a06c9b08717cb5e232a11b57b35fc98c9
Android sandbox bypassBitcoin DepotCVE-2026-39987CensysChipSoftEHR outageEngageLab SDKEurail data breach','passport dataGlassWormICS/OTIran-linked APTLucidRookMarimoRCERockwell PLCUAT-10362Zig droppercredential theftcrypto walletscryptocurrency theftdeveloper toolsmobile privacyphishingransomwaresupply chain
What happened
Multiple high-impact incidents and active threats reported: Censys identified 5,219 internet-exposed Rockwell PLCs (majority in the U.S.) amid U.S. agency warnings that Iran-linked APTs are exploiting internet-facing Rockwell devices. The GlassWorm campaign has evolved to use a Zig-based dropper hidden in fake IDE extensions to compromise developer tools and supply chains. A critical Marimo RCE (CVE-2026-39987, CVSS 9.3) was exploited within hours of disclosure. Dutch healthcare IT provider ChipSoft suffered a ransomware outage affecting EHR services across hospitals in the Netherlands andBelg
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- f82627600a244b53483fefd2315bcd9a06c9b08717cb5e232a11b57b35fc98c9
- Enrichment time
- 2026-04-12T02:51:52Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.