Nozomi Labs reports persistent abuse of weak credentials and exposed devices across OT and IoT
Nozomi Networks Labs reports persistent abuse of weak or default credentials and exposed industrial and IoT assets between June and August 2026. Faster exploit cycles and botnets that generate opportunistic traffic add volume on top, the vendor says.
The Watch · Security desk
Nozomi lists abuse of weak or default credentials and exposed industrial and IoT assets. It says AI can compress the exploit window from days to hours, OT patching is often constrained by safety and availability, and virtual patching matters more.
- exposure Industrial and IoT assets Persistent abuse of weak or default credentials and continued interest in exposed assets, Nozomi lists, claim 3
- constraint Disclosure-to-exploit window AI can compress it from days to hours, Nozomi says, citing its Zero-Days at AI Speed analysis, claim 5
- constraint OT, critical infrastructure Patching is often constrained by safety, availability and operational requirements, Nozomi says, claim 6
- capability Security, operations teams The shorter window makes virtual patching and compensating controls more important, Nozomi says, claim 7
| Who | How | Kind | Claim |
|---|---|---|---|
| Industrial and IoT assets | Persistent abuse of weak or default credentials and continued interest in exposed assets, Nozomi lists | exposure | 3 |
| Disclosure-to-exploit window | AI can compress it from days to hours, Nozomi says, citing its Zero-Days at AI Speed analysis | constraint | 5 |
| OT, critical infrastructure | Patching is often constrained by safety, availability and operational requirements, Nozomi says | constraint | 6 |
| Security, operations teams | The shorter window makes virtual patching and compensating controls more important, Nozomi says | capability | 7 |
What happened
- Nozomi says the targets included organizations in manufacturing, transportation, energy and other essential sectors.
- Nozomi says financially motivated groups were more active this summer than in the spring.
- Nozomi cites one named campaign: Russian threat actors hacking cameras to track NATO supply routes.
Why it matters
- constraint Where patching waits on safety and availability reviews, a days-to-hours exploit window shifts the load onto virtual patching, compensating controls and asset visibility.
- exposure Default logins and internet-reachable industrial devices sit in the operator's own configuration, so an inventory and a credential sweep can test the first two forces without a vendor fix.
- precedent Financially motivated activity rose against spring, so a threat model weighted toward state actors would understate this summer's opportunistic traffic.
The first two forces on Nozomi's list need no exploit code. A default login or a device reachable from the internet is enough [3]. In our view, those are the entry points an operator can test today: inventory what answers from outside, then sweep for factory passwords.
Botnet traffic hits whatever answers [4]. A device with a default credential and an open port is in that pool without anyone choosing it.
The speed claim is Nozomi's own. Its analysis, Zero-Days at AI Speed, says AI can compress the window between vulnerability disclosure and exploitation from days to hours [5]. Patching in OT is often constrained by safety, availability and operational requirements [6]. Nozomi points to virtual patching, compensating controls, continuous asset visibility and faster coordination between security and operations teams [7]. Nozomi also describes its own AI-powered Threat Intelligence as designed to identify emerging threats and new malware variants before traditional signatures are available [10].
On actors, Nozomi says the balance between state-sponsored and financially motivated groups is fluid, and that financially motivated activity rose against spring [8]. The one campaign it names involves Russian threat actors hacking cameras to track NATO supply routes [9]. Nozomi calls the overall activity sustained across the three months [1].
Everything here is Nozomi's account of its own observations. The portion of the report we reviewed does not include incident counts, CVE identifiers or how the camera access was obtained.
What to watch
- Whether Nozomi publishes counts of credential-based intrusions or exposed-device figures that let operators size the trend against their own logs.
- Whether the Zero-Days at AI Speed analysis shows the days-to-hours window with named CVEs and disclosure and exploitation dates.
- Whether further reporting ties the NATO supply-route camera campaign to default or weak credentials.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence35
- Adoption
- Insufficient
- Hype gap+25
- Incentives70
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Between June and August 2026, Nozomi Networks Labs observed sustained malicious activity across OT, IoT and critical infrastructure environments.
- [2]
Threat actors targeted organizations in Manufacturing, Transportation, Energy and other essential sectors.
- [3]
Nozomi lists persistent abuse of weak or default credentials and continued interest in exposed industrial and IoT assets among the forces shaping the summer 2026 threat landscape.
- [4]
Nozomi also lists faster vulnerability discovery and exploitation cycles and the ongoing evolution of botnets capable of generating large volumes of opportunistic traffic.
- [5]
Nozomi says its analysis Zero-Days at AI Speed highlights how AI can compress the window between vulnerability disclosure and exploitation from days to hours.
- [6]
Nozomi says patching in OT and critical infrastructure environments is often constrained by safety, availability and operational requirements.
- [7]
Nozomi says the shorter window increases the importance of virtual patching, compensating controls, continuous asset visibility and faster coordination between security and operations teams.
- [8]
Nozomi says the proportion of state-sponsored and financially motivated groups remains fluid, and that this summer it saw an increase in the activity of financially motivated groups compared to the springtime.
- [9]
Nozomi cites a campaign in which Russian threat actors hacked cameras to track NATO supply routes.
- [10]
Nozomi says its AI-powered Threat Intelligence capabilities are designed to identify emerging threats, new malware variants and suspicious activity before traditional signatures are available.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- Nozomi Networks
nozominetworks.com
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Critical infrastructureFollow
- OT SecurityFollow
- IoT SecurityFollow
- Vulnerability ManagementFollow