Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Automotive

Breach intelligence, attack campaigns, and threat reports targeting the Automotive sector.

193 threat reports
Page 1 of 17
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Automotive Threat Reports

Showing 1–12 / 193 reports
Critical XSS Vulnerability in Siemens Teamcenter Enables Silent Account Takeover
Critical XSS Vulnerability in Siemens Teamcenter Enables Silent Account Takeover
Aviation/Aerospace3 weeks ago

Critical XSS Vulnerability in Siemens Teamcenter Enables Silent Account Takeover

Bishop Fox security researchers discovered a critical reflected cross-site scripting vulnerability (CVE-2026-58113) in Siemens Teamcenter's login redirect functionality in 2024. The flaw allows attackers to execute JavaScript in authenticated users' browsers through crafted URLs, requiring no user interaction beyond opening the link. During authorized testing, researchers weaponized the vulnerability to silently grant surrogate delegation privileges, enabling one account to act on behalf of another in the PLM system that manages critical engineering designs, bills of materials, and approval workflows for aircraft, vehicles, and industrial hardware. The vulnerability affects Teamcenter's /auth/login-redirect flow where user-controlled query parameters are reflected into HTML form attributes without proper encoding, and the page's automatic form submission triggers the injected code execution. This incident highlights the growing sophistication of application-layer attacks targeting industrial control systems and engineering environments, where a single compromised account can impact manufacturing approvals and intellectual property protection across aerospace and automotive sectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
International Cooperation Targets Qilin Ransomware Leadership in Historic Germany-Japan Extradition
International Cooperation Targets Qilin Ransomware Leadership in Historic Germany-Japan Extradition
Automotive1 month ago

International Cooperation Targets Qilin Ransomware Leadership in Historic Germany-Japan Extradition

In October 2026, Germany arrested a Russian national suspected of being a core member of the notorious Qilin ransomware group following extradition from Japan. The suspect was originally detained in May 2026 at an Osaka hotel after entering Japan as a tourist, where German authorities had issued an international arrest warrant. Qilin, operating as a ransomware-as-a-service (RaaS) since 2022, has targeted over 2,350 organizations across 62 countries, including major victims like Nissan, Asahi Brewery, and the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Despite the arrest, the group remained highly active, listing over 450 new victims since June 2026. This arrest highlights the growing international law enforcement cooperation against ransomware operations and demonstrates that RaaS leaders can be tracked and prosecuted across borders. The continued activity of Qilin post-arrest underscores the distributed nature of modern ransomware operations and the persistent threat they pose to critical infrastructure worldwide.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerabilities Expose Global EV Charging Infrastructure to Cyberattacks
Critical Vulnerabilities Expose Global EV Charging Infrastructure to Cyberattacks
Oil/Energy/Solar/Greentech1 month ago

Critical Vulnerabilities Expose Global EV Charging Infrastructure to Cyberattacks

In October 2026, CISA disclosed critical vulnerabilities in Monta's electric vehicle charging platform affecting all versions of monta.app. The vulnerabilities include missing authentication for WebSocket endpoints (CVE-2026-95102), lack of rate limiting enabling brute-force attacks (CVE-2026-97363), insufficient session management (CVE-2026-97212), and publicly exposed charging station credentials (CVE-2026-93474). These flaws allow attackers to impersonate charging stations, gain unauthorized administrative control, disrupt charging services, and potentially compromise the entire EV charging network infrastructure. The vulnerabilities affect critical energy and transportation infrastructure deployed worldwide. This incident highlights the growing cybersecurity risks in smart city and critical infrastructure as IoT devices proliferate without adequate security controls. With electric vehicle adoption accelerating globally and charging networks becoming essential infrastructure, these vulnerabilities expose systemic weaknesses in industrial control systems that could enable nation-state actors or cybercriminals to disrupt transportation and energy systems at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Zero-Day in TDengine Database Threatens 730K+ Industrial Systems
Critical Zero-Day in TDengine Database Threatens 730K+ Industrial Systems
Oil/Energy/Solar/Greentech1 month ago

Critical Zero-Day in TDengine Database Threatens 730K+ Industrial Systems

A high-severity zero-day vulnerability (CVE-2026-42542) was discovered in TDengine, an open-source time-series database used across industrial, IoT, energy, and automotive sectors. The flaw allows unauthenticated attackers to crash vulnerable servers with a single malformed network packet, affecting over 730,000 instances globally including systems at Siemens, McDonald's, and Sinopec. The vulnerability stems from an integer-underflow bug in pre-authentication message parsing, making exploitation trivial for attackers with network access to the default port 6030. Ridge Security researchers developed a proof-of-concept exploit but chose not to publicly release it, while TDengine has released a patched version (3.4.1.6). This incident highlights the growing threat landscape targeting operational technology environments, where traditional IT security tools often provide inadequate coverage. As industrial systems become increasingly connected and dependent on data analytics platforms, vulnerabilities in critical infrastructure components pose escalating risks to operational continuity and safety.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Times Car Breach Exposes 6.6 Million Accounts: Automotive Industry Under Siege
Times Car Breach Exposes 6.6 Million Accounts: Automotive Industry Under Siege
Automotive1 month ago

Times Car Breach Exposes 6.6 Million Accounts: Automotive Industry Under Siege

Times Car, Japan's major vehicle rental and mobility service, confirmed a cyberattack in September 2026 that compromised 6.6 million user accounts. The breach, discovered on September 25, exposed personal information including names, addresses, driver's license data, and identity verification documents of current and former members. While passwords were stored in encrypted form and credit card information remained unaffected, the incident represents one of Japan's largest automotive sector data breaches. Times Car blocked unauthorized access on September 26 and initiated forensic investigation with external experts while maintaining normal service operations. This incident highlights the escalating threat to mobility and automotive platforms as digital transformation accelerates across transportation sectors, with attackers increasingly targeting customer databases containing sensitive identity verification documents and location data.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Psychedelic Stealer Targets Ukraine Through Fake Cloudflare ClickFix Campaign
Psychedelic Stealer Targets Ukraine Through Fake Cloudflare ClickFix Campaign
Retail Industry1 month ago

Psychedelic Stealer Targets Ukraine Through Fake Cloudflare ClickFix Campaign

In September 2026, threat actors compromised legitimate Ukrainian business websites to inject fake Cloudflare verification pages as part of a ClickFix campaign distributing Psychedelic Stealer malware. The attack targeted various Ukrainian businesses including healthcare facilities, retailers, and manufacturers, using social engineering to trick victims into executing malicious MSI installers that harvested browser credentials, cryptocurrency wallets, and account tokens. Arctic Wolf Labs documented 557 views with 426 clicks across the campaign, primarily targeting Ukrainian users but also affecting victims in the US, Poland, Germany, Canada, and the Netherlands. This incident highlights the growing sophistication of information stealer campaigns that exploit trusted brand impersonation and legitimate website compromise to bypass security controls. The emergence of new stealer families like Psychedelic, combined with advanced evasion techniques and modular malware ecosystems, represents an escalating threat to credential security and highlights the urgent need for enhanced egress filtering and behavioral monitoring capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Path Traversal Flaw Exposes Siemens Industrial Systems to Remote File Access
Critical Path Traversal Flaw Exposes Siemens Industrial Systems to Remote File Access
Industrial Automation1 month ago

Critical Path Traversal Flaw Exposes Siemens Industrial Systems to Remote File Access

Siemens SIMOVE Fleetmanager and SIPLANT industrial management systems contain a critical path traversal vulnerability (CVE-2026-67367) with a CVSS score of 8.6. The flaw allows unauthenticated remote attackers to read arbitrary files from the underlying operating system through improper validation of directory traversal sequences in the embedded HTTP server's file-serving endpoint. Affected systems span multiple product versions deployed worldwide in critical manufacturing sectors, potentially exposing sensitive data including credential stores, private keys, and configuration secrets. This vulnerability highlights the persistent security challenges in industrial control systems and operational technology environments. As organizations increasingly digitize their manufacturing operations and connect OT systems to corporate networks, path traversal vulnerabilities in critical infrastructure components represent a growing attack surface that demands immediate attention and systematic security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Critical Authentication Bypass in Mitsubishi Electric GX Works3 Exposes Industrial Control Systems
Critical Authentication Bypass in Mitsubishi Electric GX Works3 Exposes Industrial Control Systems
Industrial Automation1 month ago

Critical Authentication Bypass in Mitsubishi Electric GX Works3 Exposes Industrial Control Systems

In September 2026, CISA disclosed CVE-2026-15688, a critical authentication bypass vulnerability in Mitsubishi Electric's GX Works3 and Motion Control Settings software used in industrial control systems worldwide. The vulnerability, scored 8.8 (CVSS v3.1) and 9.2 (CVSS v4.0), allows local attackers to bypass block password authentication by modifying executable modules in memory, enabling unauthorized access to view, tamper with, destroy, or delete control programs in critical manufacturing environments. This incident highlights the growing threat landscape targeting industrial control systems as cyber adversaries increasingly focus on critical infrastructure. With ICS environments becoming more connected and the rise of sophisticated state-sponsored attacks on manufacturing facilities, authentication vulnerabilities in widely-deployed engineering software represent significant risks to operational technology security and industrial resilience.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
APT37 Embeds Malware in Load Balancers to Spy on South Korean Industries
APT37 Embeds Malware in Load Balancers to Spy on South Korean Industries
Automotive1 month ago

APT37 Embeds Malware in Load Balancers to Spy on South Korean Industries

A North Korean advanced persistent threat group, likely APT37, conducted sophisticated espionage operations against South Korean media and automotive companies throughout 2025-2026. The attackers compromised HAProxy load balancers to deploy a custom Linux toolkit called 'TED', gaining access to decrypted communications and conducting long-term surveillance operations. The group harvested credentials, modified log files to hide their tracks, and maintained persistent access to target networks for intelligence collection on media sources and manufacturing technology. This incident represents a significant evolution in APT tactics, demonstrating how threat actors are embedding malicious code directly into production infrastructure rather than deploying traditional malware. The targeting of critical industrial sectors and the sophisticated load balancer compromise technique highlight the growing threat to network appliances and the need for enhanced infrastructure security.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical XSS Vulnerability in Siemens Teamcenter Exposes Manufacturing Systems to Web-Based Attacks
Automotive1 month ago

Critical XSS Vulnerability in Siemens Teamcenter Exposes Manufacturing Systems to Web-Based Attacks

A reflected cross-site scripting (XSS) vulnerability (CVE-2026-58113) was discovered in Siemens Teamcenter's authentication redirect flow, affecting multiple versions across V2412, V2506, V2512, and V2606 product lines. The vulnerability allows unauthenticated remote attackers to inject malicious JavaScript into authenticated user sessions through crafted URLs, potentially enabling data theft and unauthorized actions within victims' Teamcenter sessions. Siemens has released patches for all affected versions and recommends immediate updates to mitigate the CVSS 6.1 rated vulnerability. This incident highlights the persistent threat of web application vulnerabilities in critical manufacturing systems, particularly as organizations increasingly rely on web-based PLM platforms for sensitive industrial operations and intellectual property management.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
IDScan Breach Exposes 153 Million Driver's Licenses: A Wake-Up Call for Identity Verification Security
IDScan Breach Exposes 153 Million Driver's Licenses: A Wake-Up Call for Identity Verification Security
Financial Services1 month ago

IDScan Breach Exposes 153 Million Driver's Licenses: A Wake-Up Call for Identity Verification Security

In September 2026, identity verification company IDScan confirmed a significant data breach affecting over 153 million driver's license scans and personal identification documents. Threat actors gained unauthorized access to IDScan's cloud platform, compromising customer data including full names, driver's license numbers, and scanned copies of government-issued IDs. The stolen data was subsequently advertised on a dark web platform called 'Nexus' before being taken offline following FBI investigation. IDScan provides identity verification services to car rental companies, financial institutions, cannabis dispensaries, and hospitality businesses across the US and Canada. This incident highlights the growing threat to identity verification infrastructure as cybercriminals increasingly target centralized repositories of sensitive personal data. The breach demonstrates how third-party service providers handling critical identity documents have become high-value targets, creating cascading privacy risks across multiple industries that rely on these verification services.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Warns of Critical Security Gaps in Edge AI Deployments
Microsoft Warns of Critical Security Gaps in Edge AI Deployments
Health Care / Life Sciences2 months ago

Microsoft Warns of Critical Security Gaps in Edge AI Deployments

Microsoft published a comprehensive security advisory in September 2024 addressing critical vulnerabilities in Edge AI deployments where machine learning models execute on customer-owned infrastructure. The advisory highlights fundamental security model changes when AI systems move from centralized cloud services to edge environments, exposing organizations to prompt injection attacks, model tampering, and malicious firmware updates. Customer-owned Edge AI deployments face increased attack surfaces as models, credentials, and sensitive data operate in potentially hostile environments outside cloud providers' direct security controls. This advisory emerges as organizations rapidly adopt Edge AI for cost optimization, data sovereignty, and reduced latency, creating new attack vectors that traditional software security controls cannot adequately address.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports