Wire a PLC to a cellular modem and the device takes its address from a carrier, not from anything you administer. The write-up names that as the core problem: configurations that allow direct reachability to PLCs without passing through corporate IT networks [6]. A normal enterprise detection stack sits on the wrong side of that single hop. The traffic never crosses the proxy, so the proxy has nothing to show [7]. The identity provider sees a login only when a VPN or gateway brokered it, which this design skips by construction [8]. PLCs run no agent, so EDR simply isn't in play, leaving engineering workstations and jump hosts as the nearest supporting evidence [9]. And depending on NAT and how the carrier allocates addresses, the asset may never appear in a standard inventory [5].
What the count means depends on which rung of the write-up's own triage ladder it sits on. There are three: attempt observed, authentication success confirmed, subsequent compromise confirmed [10][11][13]. July's activity sits on the bottom rung, because nothing public confirms that authentication or manipulation succeeded on any individual system [13][21]. Reaching the second rung requires successful unauthorised logins evidenced in device or gateway logs [10]. The same document lists absent OT network monitoring and remote access logging as a contributing weakness [12]. The evidence that would upgrade the finding is missing for the same reason the exposure exists [22]. Read the zero-confirmed-compromises tally as a property of the logging, not as proof nothing happened.
That caps what you can borrow. No credentials, vulnerabilities, protocols, commands or configuration change procedures have been published [14], so there is no indicator to load and no specific CVE to chase. What transfers is the shape: a controller with a carrier-routable address and a live management interface, in a place your asset database does not describe.
The remediation list is short and expensive. Consolidate access behind secure gateways, jump hosts or VPNs [15], then change default passwords and add updates, MFA, allowlisting and least privilege, plus external attack surface discovery and continuous OT traffic monitoring [16]. Read that as a staffing plan rather than a project. The modem is there because a two-person utility needed to change a setpoint at 02:00 without driving to the plant. Pull the modem without replacing that capability and the operational risk simply relocates instead of going away, which is why the shortcut keeps getting rebuilt after every advisory.
Provenance matters for how hard you lean on this. The summary credits SecurityWeek's report of CISA's observation, rates the item High, and points at CISA's internet exposure reduction guidance as the related resource [20]. No critical operational disruption, water outage or water quality effect has been reported [3]. The one measurement in this story that was taken from the same vantage point as the attacker is an external scan of your own carrier address space, which is why it appears on the mitigation list rather than in the incident report [16].
