What the Internet Sees

Attackers don't guess. They look. And the internet, if you know how to read it, shows you almost everything. I work at Censys, where we scan the entire public internet every single day, across all 65,000 ports and protocols, build a Internet Map and refresh the map multiple times a day.

What that data shows consistently, across years, across threat campaigns, across geographies is a gap that I think about more than I probably should.

Adversaries see the internet. Defenders see a subset of it.

That gap is what this series is about.

The Weekend Thirty Water Systems Went Dark

Let me start with what happened three weeks ago, because it's the clearest illustration I've seen of what this gap costs in practice.

On the weekend of July 26-27, 2026, hackers disrupted more than 30 community water systems across Minnesota. They didn't breach a corporate network. They didn't use an exploit that nobody had seen before. They ran a scanner, found programmable logic controllers sitting on the open internet. The computers that run pumps, valves, and chemical dosing systems at water treatment plants and logged in. Then they changed the passwords to lock operators out and modified device IP addresses to kill remote access. Utilities issued boil-water notices. Staff switched to manual operations.

CISA issued an emergency sector-wide alert two days later. Get your PLCs off the internet. Immediately.

Within hours of that alert, Censys scan data showed exactly what the attackers had been looking at before they made their first move: 4,148 Rockwell/Allen-Bradley EtherNet/IP controllers reachable from the open internet. 71% of them in the United States. 59% of those U.S. devices connected through cellular modems like Verizon, AT&T, T-Mobile that were potentially absent from asset inventory tracking systems, and visible to people that knew where to look.

This Wasn't the First Time

The Minnesota attacks were the third Iranian-linked campaign using this same method in three years.

In November 2023, the same threat actors linked to the IRGC, tracked as CyberAv3ngers hit more than 75 Unitronics PLCs at U.S. water and wastewater facilities. The Unitronics devices shipped from the factory with a default password. Scan for exposed devices, authenticate with the factory default, manipulate what you find. Simple. Effective. Documented.

In April 2026, the same group pivoted to Rockwell Automation controllers. This time they didn't even need a default credential they downloaded Rockwell's own legitimate vendor software from the internet and pointed it at 5,219 globally exposed devices, 74.6% of them in the United States.

Then July. Minnesota. Thirty systems.

Three campaigns. Three device manufacturers. One method.

What changed between 2023 and 2026 wasn't the attacker's capability. It was the target list. They're working through the catalog of internet-exposed American industrial control systems, vendor by vendor, because the catalog is right there on the internet for anyone to read.

What I Actually See From Where I Sit

I'm not a policy person. I'm not writing a white paper. I'm a product guy at Censys who is spending time building the Internet Map. Here's what the data shows that most people don't realize:

The exposure isn't exotic. It's not sophisticated vulnerabilities or nation-state-only tooling. It's FTP servers running a 1971 protocol without encryption. Nearly 6 million of them, 2.45 million with no encryption at all, transmitting credentials in cleartext right now. It's PLCs with default passwords. It's cellular modems that nobody wrote down. The entry points that matter most are the obvious ones.

Remediation works, fast. This is the part that gets lost in the doom. After the 2023 Unitronics campaign, exposure of those device types dropped. After the April 2026 Rockwell advisory, numbers fell. When the Censys ARC team identified 400+ exposed human-machine interfaces at U.S. water facilities and shared the data with the EPA, more than 96% of them disappeared from the public internet within weeks. Not months. Weeks. No new law, no new budget. Just: here's what's exposed, here's who owns it, go fix it.

Adversary infrastructure is also visible. This one still surprises people. In March 2026, Censys ARC researchers discovered a previously undocumented Russian remote access toolkit. Credential phishing, keylogging, RDP hijacking, and reverse proxy tunneling, not through a classified tip or a partner referral, but through open directory scanning. The toolkit's staging server was sitting on the public internet. Absent from every threat intelligence feed. Found because someone looked.

The same internet that exposes American infrastructure exposes adversary infrastructure too. The question is whether defenders are looking as systematically as the attackers are.

What This Series Is

It is not about policy prescriptions. It is to highlight what the data reveals and what I don't hear talked about plainly enough outside of technical security circles. I've been in this industry long enough to know that the distance between "we can see this problem clearly" and "we are actually solving it" can be very large. I'm writing this series because I think the seeing part is underrated and because I think it's possible to close that distance faster than most people assume.

Each piece will be built on publicly available research, most of it published by Censys ARC, some of it from CISA advisories and threat intelligence reports that anyone can read. Nothing proprietary. Nothing classified. Just: here's what the public data shows, here's what I make of it, here's what I think it means.