Find what you’re looking for
Browse everything
6,892 results in Threat Reports
Silver Dragon 2026: Unveiling APT41's Covert Cyberespionage Tactics
In mid-2024, the Chinese state-sponsored group Silver Dragon, associated with APT41, initiated cyberespionage campaigns targeting government organizations across Southeast Asia and Europe. The group gained initial access through exploiting public-facing servers and phishing emails containing malicious attachments. To maintain persistence, Silver Dragon hijacked legitimate Windows services, allowing their malware to blend seamlessly with normal system activities. They deployed custom tools like GearDoor, which utilized Google Drive for covert command-and-control communications, SSHcmd for remote access, and SliverScreen for capturing user activity screenshots. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who are increasingly leveraging trusted cloud services and legitimate system processes to evade detection. The use of such sophisticated methods highlights the need for organizations to enhance their cybersecurity measures and remain vigilant against advanced persistent threats. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai))
Critical Command Injection Vulnerability in VMware Aria Operations
In February 2026, a critical command injection vulnerability (CVE-2026-22719) was identified in VMware Aria Operations, allowing unauthenticated attackers to execute arbitrary commands during support-assisted product migrations. This flaw, with a CVSS score of 8.1, could lead to remote code execution and full system compromise. Broadcom released patches and workarounds to address the issue. ([support.broadcom.com](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on March 3, 2026, indicating active exploitation in the wild. Federal agencies are mandated to apply the fixes by March 24, 2026. ([thehackernews.com](https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html?utm_source=openai))
INTERPOL's Operation Sentinel: A Landmark Cybercrime Crackdown in Africa
Between October 27 and November 27, 2025, INTERPOL coordinated Operation Sentinel, a significant cybercrime crackdown across 19 African countries. The operation led to the arrest of 574 suspects involved in business email compromise (BEC), digital extortion, and ransomware attacks. Authorities dismantled over 6,000 malicious links, decrypted six ransomware variants, and recovered approximately USD 3 million. The cases investigated were linked to estimated financial losses exceeding USD 21 million. Notable incidents included a thwarted USD 7.9 million BEC attempt targeting a petroleum company in Senegal and a ransomware attack in Ghana that encrypted 100 terabytes of data, with nearly 30 terabytes successfully recovered. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai)) This operation underscores the escalating threat of cybercrime in Africa, with online offenses now accounting for a significant proportion of all crimes in many regions. The success of Operation Sentinel highlights the effectiveness of international collaboration in combating cyber-related offenses and the critical need for continued vigilance and cooperation to protect critical infrastructure and sensitive data. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai))
Critical Vulnerabilities in Everon's OCPP Backends Threaten EV Charging Security
In March 2026, multiple critical vulnerabilities were identified in Everon's OCPP Backends, affecting all versions of the platform. These vulnerabilities include missing authentication for critical functions, improper restriction of excessive authentication attempts, insufficient session expiration, and insufficiently protected credentials. Exploitation of these flaws could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([incibe.es](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-ocpp-backends-de-everon?utm_source=openai)) The discovery of these vulnerabilities underscores the growing cybersecurity risks within the electric vehicle (EV) charging infrastructure. As the adoption of EVs accelerates, ensuring the security of charging networks becomes paramount to prevent potential operational disruptions and safeguard user data.
Critical Vulnerabilities in Hitachi Energy's Relion REB500: Immediate Action Required
In February 2026, Hitachi Energy disclosed two significant vulnerabilities in its Relion REB500 product, identified as CVE-2026-2459 and CVE-2026-2460. These flaws allow authenticated users with specific roles to access and modify unauthorized directories, potentially compromising system integrity. The vulnerabilities affect versions up to and including 8.3.3.0. Hitachi Energy has released version 8.3.3.1 to address these issues and recommends users update promptly. ([cve.qwiksec.com](https://cve.qwiksec.com/cve/CVE-2026-2460?utm_source=openai)) This incident underscores the critical importance of stringent access controls and timely software updates in industrial control systems, especially within the energy sector. Organizations must remain vigilant against privilege escalation vulnerabilities to safeguard operational technology environments.
Critical Vulnerabilities in Mitsubishi Electric's MELSEC iQ-F Series Expose Industrial Systems to Denial-of-Service Attacks
In March 2026, Mitsubishi Electric disclosed multiple vulnerabilities in their MELSEC iQ-F Series EtherNet/IP and Ethernet modules, specifically FX5-ENET/IP and FX5-EIP models. These flaws, identified as CVE-2026-1874, CVE-2026-1875, and CVE-2026-1876, allow remote attackers to induce denial-of-service conditions by continuously sending UDP packets, rendering the devices unresponsive until a system reset is performed. The vulnerabilities affect FX5-ENET/IP versions up to 1.106 and all versions of FX5-EIP. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-1874?utm_source=openai)) This incident underscores the critical need for robust network security measures in industrial control systems, as such vulnerabilities can disrupt essential operations in critical manufacturing sectors worldwide. Organizations are advised to implement recommended mitigations, including updating firmware where available and employing network defenses to prevent unauthorized access. ([cyber.gc.ca](https://www.cyber.gc.ca/en/alerts-advisories/control-systems-mitsubishi-electric-security-advisory-av26-191?utm_source=openai))
Critical Vulnerability in Portwell Engineering Toolkits Poses Risks to Industrial Control Systems
In March 2026, a critical vulnerability (CVE-2026-3437) was identified in Portwell Engineering Toolkits version 4.8.2, widely used in industrial control systems. This flaw allows local authenticated attackers to read and write arbitrary kernel memory via the toolkit's driver, potentially leading to privilege escalation or denial-of-service conditions. The vulnerability has a CVSS v3.1 base score of 8.8, indicating high severity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-3437?utm_source=openai)) The vulnerability underscores the importance of securing engineering workstations in industrial environments, as exploitation could compromise critical manufacturing and energy sectors. Organizations are advised to implement defense-in-depth strategies, restrict access to engineering systems, and monitor for unauthorized activities to mitigate potential risks. ([therealistjuggernaut.com](https://therealistjuggernaut.com/2026/03/03/portwell-engineering-toolkits-vulnerability-raises-privilege-escalation-risks-in-industrial-development-environments/?utm_source=openai))
Critical Vulnerabilities Uncovered in ePower's Charging Platform
In March 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory highlighting multiple critical vulnerabilities in ePower's charging platform, epower.ie. These vulnerabilities include missing authentication for critical functions, improper restriction of excessive authentication attempts, insufficient session expiration, and insufficiently protected credentials. Exploitation of these flaws could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-of-epower-charging-platform-vulnerabilities-and-mitigations.403849/?utm_source=openai)) The disclosure underscores the growing cybersecurity risks in the energy and transportation sectors, particularly concerning electric vehicle (EV) infrastructure. As EV adoption accelerates, ensuring the security of charging networks becomes paramount to prevent potential disruptions and maintain public trust in these emerging technologies.
Critical Vulnerability in Labkotec LID-3300IP Threatens Industrial Control Systems
In March 2026, a critical vulnerability (CVE-2026-1775) was identified in Labkotec's LID-3300IP ice detector software, allowing unauthenticated attackers to alter device parameters and execute operational commands via specially crafted packets. This flaw, stemming from missing authentication for critical functions, poses significant risks to industrial control systems, particularly in sectors like energy and communications. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-1775?utm_source=openai)) The vulnerability underscores the growing threat landscape for industrial control systems, emphasizing the need for robust authentication mechanisms and network security practices to prevent unauthorized access and potential operational disruptions.
Mobiliti e-mobi.hu 2026 Authentication Vulnerabilities Expose Critical Infrastructure Risks
In March 2026, multiple critical vulnerabilities were identified in Mobiliti's e-mobi.hu platform, a key player in Hungary's electric vehicle charging infrastructure. These flaws, including missing authentication for critical functions and insufficient session expiration, could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. The vulnerabilities affect all versions of the e-mobi.hu platform, posing significant risks to the energy and transportation sectors. ([windowsforum.com](https://windowsforum.com/threads/cisa-advisories-warn-of-critical-authentication-and-session-flaws-in-mobiliti-e-mobi-platform.403855/?utm_source=openai)) This incident underscores the growing cybersecurity challenges in critical infrastructure, particularly within the rapidly expanding electric vehicle sector. As the adoption of EVs increases, ensuring the security of associated charging networks becomes paramount to prevent potential disruptions and maintain public trust.
Critical Vulnerabilities in Hitachi Energy RTU500 Series Require Immediate Attention
In February 2026, Hitachi Energy disclosed multiple vulnerabilities affecting its RTU500 series products, including CVE-2026-1772, CVE-2026-1773, CVE-2024-8176, and CVE-2025-59375. These vulnerabilities, if exploited, could lead to unauthorized access to user management information and potential device outages. The affected firmware versions range from 12.7.1 to 13.8.1. Hitachi Energy has released firmware updates to address these issues and recommends users implement the provided mitigations to secure their systems. This incident underscores the critical importance of timely vulnerability management in industrial control systems, especially within the energy sector. Organizations are urged to stay vigilant and apply security patches promptly to mitigate potential risks associated with such vulnerabilities.
Coruna Exploit Kit: Unveiling the First Mass-Scale iOS Attack
In early 2026, security researchers uncovered the 'Coruna' exploit kit, a sophisticated suite of hacking tools capable of compromising iPhones running older iOS versions. Initially identified in February 2025 during a surveillance vendor's attempt to deploy spyware on behalf of a government client, Coruna was later observed in attacks targeting Ukrainian users by a Russian espionage group and subsequently by financially motivated hackers in China. The exploit kit chains together multiple vulnerabilities, allowing attackers to bypass iOS defenses and gain full control over targeted devices. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai)) The proliferation of Coruna underscores the risks associated with the leakage of advanced cyber tools originally developed for government use. Similar to the EternalBlue exploit that fueled the WannaCry and NotPetya attacks in 2017, Coruna's widespread availability has enabled various threat actors to conduct mass-scale attacks on iOS devices, affecting at least 42,000 devices to date.