The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Automotive
Breach intelligence, attack campaigns, and threat reports targeting the Automotive sector.
Explore Other Sectors
Automotive Threat Reports
Critical AutomationDirect PLC Vulnerabilities Expose Manufacturing to Cyber Risk in 2025
In October 2025, AutomationDirect disclosed multiple critical vulnerabilities affecting its Productivity Suite and a range of Productivity 1000, 2000, and 3000 PLC models, widely deployed in the manufacturing sector. Discovered by Nozomi Networks, the flaws—such as remote code execution, weak password recovery, and unrestricted file system access—could allow unauthenticated attackers to gain full control of affected devices, compromise sensitive project files, and disrupt industrial processes. The vulnerabilities could be exploited remotely with low attack complexity and no user interaction. This incident highlights rising risks posed by legacy and poorly segmented OT networks, as threat actors increasingly target industrial control systems. The sharp jump in the number and severity of disclosed PLC software vulnerabilities underscores the urgent need for enhanced segmentation, access controls, and monitoring in critical infrastructure environments.
8 months ago
Kill Chain
CISA Flags DELMIA Apriso Vulnerabilities: Urgent Action for Manufacturers
In October 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities affecting Dassault Systèmes DELMIA Apriso (CVE-2025-6204 and CVE-2025-6205) to its Known Exploited Vulnerabilities (KEV) Catalog following confirmed evidence of active exploitation in the wild. The code injection and missing authorization flaws present serious security bypass opportunities, allowing malicious actors to achieve unauthorized access and potentially execute arbitrary code. These weaknesses have become high-value targets for cyber attackers, potentially threatening sensitive enterprise manufacturing and operational data integrity across organizations that have yet to apply available patches. This incident underscores the growing trend of rapid exploitation of industrial software vulnerabilities by sophisticated threat actors. With regulatory frameworks such as BOD 22-01 placing increasing responsibility on federal agencies to remediate such vulnerabilities quickly, all organizations must adapt their patch management and risk processes to respond to elevated attacker velocity.
8 months ago
Kill Chain
ISO 15118-2 EV Charging Protocol Vulnerability: Man-in-the-Middle Risk in 2025
In October 2025, a critical vulnerability (CVE-2025-12357) impacting the ISO 15118-2 standard for electric vehicle (EV) chargers was disclosed. The flaw centers on improper restriction of communication channels, specifically enabling attackers to exploit the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements. This manipulation facilitates man-in-the-middle attacks between EVs and compliant chargers, with attacks feasible wirelessly and in close proximity via electromagnetic induction. The vulnerability jeopardizes authentication and data exchange during the EV charging process but has not yet been publicly exploited. The incident highlights escalating risks across connected infrastructure, especially as EV adoption surges globally. As regulators, manufacturers, and utility providers converge on charging protocols, the need for mandatory end-to-end encryption is increasingly urgent to safeguard against evolving threat actors targeting critical transportation sectors.
8 months ago
Kill Chain
CISA Alert: Active Exploits Target Dassault DELMIA Apriso and XWiki in 2025
In October 2025, cybersecurity authorities including CISA confirmed active exploitation of critical vulnerabilities in Dassault Systèmes DELMIA Apriso and XWiki platforms. Threat actors leveraged flaws such as CVE-2025-6204—an 8.0 CVSS code injection bug—to gain unauthorized access and potential code execution on affected systems. The attackers exploited unpatched systems to facilitate lateral movement, data exfiltration, and possible disruption of manufacturing and enterprise workflows. Affected organizations faced immediate operational risk and the prospect of sensitive information compromise. This incident highlights a growing trend in rapid exploitation of recently disclosed enterprise software vulnerabilities. With increased attacker focus on supply chain and collaborative platforms, organizations must respond swiftly to new advisories and prioritize vulnerability management programs to reduce exposure to high-severity threats.
8 months ago
Kill Chain
Active Exploitation of Dassault DELMIA Apriso Vulnerabilities Impacts Manufacturing Sector
In June 2024, CISA issued an alert highlighting active exploitation of two vulnerabilities (CVE-2024-22120 and CVE-2024-22121) within Dassault Systèmes’ DELMIA Apriso platform, a widely used manufacturing operations management solution. The flaws, found in DELMIA Apriso Release 2017 to 2023, allow unauthenticated attackers to execute remote code, potentially compromising production environments and exposing sensitive operational data. Attackers are leveraging these vulnerabilities to target the manufacturing sector for automated ransomware deployment and data exfiltration, resulting in operational disruption and risk to production integrity. This incident underscores the trend of threat actors focusing on supply chain and OT/IT hybrid platforms, exploiting unpatched flaws for initial access. The urgent CISA advisory signals accelerating regulatory scrutiny and highlights the increased risks posed by software supply chain weaknesses in critical infrastructure sectors.
8 months ago
Kill Chain
Laser Attacks on Vehicle Microchips: New Frontiers in Auto Cybersecurity
In 2024, security researchers demonstrated a novel cyberattack targeting automotive microchips using precisely aligned laser beams. The attack exploited fundamental hardware vulnerabilities, allowing adversaries to manipulate or extract data from silicon chips embedded in modern vehicles. By directing lasers at sensitive circuits, attackers could trigger faults, bypass certain security controls, and potentially gain access to encrypted data streams or control automotive systems. The proof-of-concept underscores critical exposure across connected and autonomous vehicles, as physical access to components can enable advanced attacks beyond the reach of traditional software-based defenses. This incident is particularly relevant as vehicles and other IoT systems grow increasingly reliant on sophisticated microelectronics. The emergence of physical-layer hardware attacks highlights the urgent need for new security architectures, including microchip hardening and multi-layered threat detection, to counter evolving risks in transportation and critical infrastructure.
8 months ago
Kill Chain
New CAPI Backdoor Targets Russian Auto & E-Commerce with Phishing ZIPs
In October 2025, cybersecurity researchers uncovered a sophisticated phishing campaign targeting Russian automobile and e-commerce firms. The attackers distributed phishing emails containing malicious ZIP files, which, when opened, triggered the deployment of a never-before-seen .NET-based malware known as the CAPI Backdoor. Once installed, the malware established persistent access, enabling threat actors to conduct internal network reconnaissance, exfiltrate sensitive information, and potentially disrupt business operations. Seqrite Labs, who analyzed the activity, report that the campaign’s execution appears highly tailored to exploit Russia’s rapidly digitizing sectors. This incident is significant amid a sharp increase in spear phishing and backdoor campaigns against supply chain and commercial organizations across Eastern Europe. The novelty of the CAPI Backdoor highlights evolving attacker sophistication and amplifies regulatory attention around encrypted traffic inspection, zero trust, and rapid anomaly detection.
8 months ago
Kill Chain
Renault and Dacia UK 2025: Customer Data Breach Highlights Supply Chain Risks
In October 2025, Renault and Dacia UK notified customers of a data breach resulting from a cyberattack at an undisclosed third-party provider. The breach exposed sensitive information including full names, gender, phone numbers, email and postal addresses, as well as vehicle identification and registration numbers. While no financial data was compromised, this incident potentially increases the risk of phishing, scams, and targeted social engineering. Renault confirmed that the third-party provider contained the incident and regulatory authorities, including the UK’s Information Commissioner's Office, were notified as part of standard response. This event highlights the persistent risks posed by supply chain vulnerabilities, where companies are exposed through third-party relationships. As cyberattackers increasingly target vendors to bypass primary defenses, organizations must intensify scrutiny of their supply chains and enhance segmentation, monitoring, and incident response to align with evolving regulatory and threat landscapes.
8 months ago
Kill Chain
Jaguar Land Rover Ransomware Breach: 2024 Supply Chain Disruption Case Study
In early 2024, Jaguar Land Rover (JLR) suffered a disruptive ransomware attack that exposed the company’s vulnerability to advanced persistent threats. Attackers, suspected to be Medusa ransomware operators, leveraged residual access from a prior breach to re-enter JLR’s systems, eventually encrypting sensitive data and disrupting operations across its supply chain. The breach forced significant production slowdowns, delayed supplier payments, and prompted the company to enact emergency IT protocols and notify regulatory authorities. This incident highlights the growing threat of repeat ransomware campaigns targeting global manufacturers and their digital supply chains. It underscores the critical need for continuous detection, east-west network visibility, and rigorous post-breach remediation in defending against evolving ransomware tactics.
8 months ago
Kill Chain
Multi-Vector Cyber Assault 2025: CarPlay, Cloud SQL, & iCloud Under Attack
In October 2025, coordinated threat actors launched a multi-vector attack campaign leveraging a critical CarPlay exploit, BYOVD (Bring Your Own Vulnerable Driver) tactics, SQL server compromise for covert command-and-control (C2), and targeted backdoor deployments against iCloud accounts. Attackers exploited unpatched vulnerabilities across automotive infotainment systems, enterprise firewalls, and cloud environments, enabling lateral movement and persistent access. The campaign demonstrated a sophisticated blend of supply chain targeting, abuse of trusted encryption protocols, malicious browser extension injection, and data exfiltration at scale. Impacted organizations faced substantial operational disruption, data loss, and the risk of regulatory penalties due to exposure of sensitive customer information and business-critical systems. This incident underscores the rapid evolution of attacker tradecraft, particularly in hybrid infrastructures and connected vehicles. The convergence of cloud, automotive, and critical business services in a single campaign highlights the increasing necessity for comprehensive, real-time security that spans east-west traffic, encrypted channels, and multi-cloud platforms.
8 months ago
Kill Chain
Motility Software Suffers Major Ransomware Breach Impacting Over 766,000 Clients
In June 2024, Motility Software Solutions, a prominent provider of dealer management software, suffered a ransomware attack that resulted in the unauthorized access and exposure of sensitive data from approximately 766,000 clients. The attackers infiltrated Motility's networks, deployed ransomware to encrypt critical systems, and exfiltrated customer data, including personal and financial information. The attack caused significant operational disruptions for both Motility and its dealership clients, who rely on the platform for daily business operations. The incident highlights the persistent threat ransomware actors pose to software supply chains serving multiple downstream businesses. This breach is especially noteworthy amid an ongoing rise in ransomware targeting SaaS and vertical market providers, with attackers prioritizing data exfiltration for extortion. Regulators and business partners are increasing their demands for improved security controls and rapid incident disclosure, especially for service providers entrusted with large volumes of sensitive client data.
8 months ago
Kill Chain
Jaguar Land Rover’s 2025 Ransomware Crisis: Lessons on Supply Chain and Zero Trust Resilience
In September 2025, Jaguar Land Rover (JLR) was forced to halt production across multiple plants after suffering a catastrophic ransomware attack. The incident resulted in severe IT system disruption, suspended manufacturing operations, and subsequent data theft. A cybercrime group calling itself 'Scattered Lapsus$ Hunters' – reportedly linked to Scattered Spider and ShinyHunters – claimed responsibility, providing evidence of internal SAP system access. The attack’s impact exposed JLR’s business continuity vulnerabilities, prompted supply chain paralysis, and led the UK government to back a significant £1.5 billion loan guarantee to stabilize operations and prevent wider economic fallout. The breach highlights how ransomware actors are increasingly targeting critical manufacturing and supply chains for greater leverage. With mounting regulatory pressure and evolving attack tactics, strengthening enterprise resilience, zero trust architectures, and segmentation is more urgent than ever.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports