they are probably on the wide open internet with hardcoded creds too. https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-...