Internet-Exposed Industrial Controllers — Shodan/Censys Scan Data
As of April 2026. The CyberAv3ngers used public scanning tools to find these devices.
Modbus TCP Devices
Port 502 · All vendors
Includes Schneider, Wago, and other vendors. Not all are M580. Source: Shodan global scan.
Rockwell Automation
EtherNet/IP · Port 44818
Primary target of CyberAv3ngers campaign. Confirmed in CISA AA26-097A advisory.
Widely reported Shodan figure for S7 protocol exposure.
N/A — Not separately enumerable via protocol scan
ABB controllers use standard protocols (Modbus, OPC UA) shared with other vendors. No unique protocol fingerprint for scanning.
Phoenix Contact
Various protocols
N/A — Not separately enumerable via protocol scan
Phoenix Contact PLCs lack a vendor-specific protocol signature. Counts are subsumed in Modbus TCP totals above.
78,700+ Modbus TCP devices exposed globally — includes Schneider, Wago, and other vendors. Not all are Schneider M580. The Modbus protocol carries no vendor identifier, so precise per-vendor breakdowns require banner analysis or secondary fingerprinting.
Sources
Shodan, Censys, CISA AA26-097A, CloudSEK Threat Landscape Assessment