According to a recent LinkedIn post from Cato Networks, the company’s threat researchers observed a global campaign from September to November 2025 targeting internet‑exposed programmable logic controllers via the Modbus protocol. The post cites activity across 70 countries, involving 14,426 targeted IP addresses and indications of automated probing, with a subset of activity suggesting deeper device fingerprinting and potential manipulation paths.
Claim 55% Off TipRanks
- Unlock hedge fund-level data and powerful investing tools for smarter, sharper decisions
- Discover top-performing stock ideas and upgrade to a portfolio of market leaders with Smart Investor Picks
The post further notes that some activity sources were geolocated to China and emphasizes that exposing Modbus interfaces directly to the public internet may significantly raise operational risk and attack likelihood. For investors, this research positioning may reinforce Cato Networks’ role in industrial and operational technology security, potentially supporting demand for its network security offerings as critical infrastructure operators reassess exposure to legacy industrial protocols.
The findings could signal rising threat levels for industrial, manufacturing, and utilities sectors, which may drive increased security spending and interest in vendors focused on securing OT and SCADA environments. If Cato Networks leverages this research to enhance product features or offer specialized protection for Modbus and similar protocols, it could strengthen its competitive differentiation in the secure networking and SASE markets.
More broadly, the post suggests that persistent, automated reconnaissance against industrial control systems is ongoing and global in scope. This trend may support a long‑term growth narrative for cybersecurity providers serving industrial and critical infrastructure clients, a segment in which Cato Networks appears to be seeking greater visibility and thought‑leadership based on its threat research output.