The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Aviation/Aerospace
Breach intelligence, attack campaigns, and threat reports targeting the Aviation/Aerospace sector.
Explore Other Sectors
Aviation/Aerospace Threat Reports
Critical Vulnerabilities in Siemens Simcenter Femap: Update Now
In August 2026, Siemens disclosed two critical vulnerabilities (CVE-2026-59700 and CVE-2026-59701) in its Simcenter Femap software, versions prior to V2606.0001. These out-of-bounds read vulnerabilities occur when parsing specially crafted BMP files, potentially allowing attackers to execute arbitrary code within the application's context. Siemens has released version V2606.0001 to address these issues and recommends users update promptly. This incident underscores the persistent risk of file parsing vulnerabilities in engineering software, highlighting the importance of timely updates and robust security practices to mitigate potential exploitation.
1 month ago
Kill Chain
Critical Vulnerabilities in Siemens Solid Edge: Immediate Update Required
In May 2026, Siemens disclosed multiple vulnerabilities in its Solid Edge SE2026 software, specifically affecting versions prior to Update 5. These vulnerabilities, identified as CVE-2026-44411 and CVE-2026-44412, involve uninitialized pointer access and stack-based buffer overflow issues that can be exploited through specially crafted PAR files. Successful exploitation could allow attackers to execute arbitrary code within the context of the current process. Siemens has released Update 5 to address these issues and strongly recommends users to upgrade to this latest version. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-921111.html?utm_source=openai)) This incident underscores the critical importance of timely software updates and vigilance against file-based attack vectors. As attackers increasingly target vulnerabilities in widely used design software, organizations must prioritize patch management and implement robust security measures to mitigate such risks.
1 month ago
Kill Chain
Critical Vulnerability in Siemens Parasolid: CVE-2026-64629
In August 2026, Siemens disclosed a critical out-of-bounds read vulnerability (CVE-2026-64629) in its Parasolid software, specifically affecting versions V38.0 prior to V38.0.235 and V38.1 prior to V38.1.230. This flaw could be exploited when the application processes specially crafted X_T files, potentially allowing attackers to crash the application or execute arbitrary code within the context of the current process. Siemens promptly released updates to address this vulnerability and strongly recommends users upgrade to the latest versions to mitigate potential risks. This incident underscores the persistent threat posed by file parsing vulnerabilities in widely used industrial software. Organizations relying on Siemens Parasolid should prioritize applying the provided patches to safeguard their systems against potential exploitation. Additionally, this serves as a reminder of the importance of maintaining up-to-date software and implementing robust security measures to protect against emerging threats.
1 month ago
Kill Chain
Jewelbug's 2026 Government Webmail Breach and Crypto Fraud
In August 2026, the Chinese state-sponsored hacking group known as Jewelbug (also referred to as Earth Alux and REF7707) executed a sophisticated cyber-espionage campaign targeting government webmail systems in a Middle Eastern country. By compromising a shared web-hosting platform operated by the national telecommunications provider, Jewelbug gained write access to the webmail installation used by multiple government ministries and agencies. They injected a malicious script into the common template, which, upon execution, established a WebSocket connection to the attackers' command-and-control server, exfiltrated webmail cookies, and retrieved users' email addresses to identify and further exploit high-value government domains. This breach affected 15 government tenants, allowing the attackers to monitor and manipulate sensitive communications. Concurrently, Jewelbug engaged in large-scale cryptocurrency fraud operations, utilizing AI-generated content and click-fraud bots to drive traffic to fraudulent crypto exchange sites, resulting in significant financial losses. ([securityonline.info](https://securityonline.info/chinas-jewelbug-apt-breaches-russian-it-provider-for-5-months-using-yandex-cloud-and-graph-api-c2/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who are increasingly blending traditional espionage with financially motivated cybercrime. The dual nature of Jewelbug's operations highlights the necessity for organizations to adopt comprehensive cybersecurity measures that address both information security and financial fraud. The use of AI and automation in these attacks also signals a shift towards more sophisticated and scalable cyber threats, necessitating continuous vigilance and adaptation of defense strategies.
1 month ago
Kill Chain
Lazarus Group's Operation Dream Job: Exploiting Windows Zero-Day to Target Defense Firms
In July 2026, the North Korean state-sponsored Lazarus Group exploited a Windows zero-day vulnerability (CVE-2026-68820) to target defense-sector companies in Europe and India. This vulnerability, a use-after-free flaw in the Windows Ancillary Function Driver for WinSock (AFD.sys), allowed attackers to escalate local privileges to SYSTEM level. The group utilized this exploit in their Operation Dream Job campaign, delivering malicious payloads through fraudulent recruitment offers to employees in defense, aerospace, and aviation organizations. The attacks led to unauthorized access, data exfiltration, and deployment of advanced malware, including the FudModule rootkit and the Troy backdoor, compromising sensitive military technologies such as surveillance sensors, drones, and robotics. This incident underscores the persistent threat posed by nation-state actors leveraging zero-day vulnerabilities to infiltrate critical sectors. The Lazarus Group's continued evolution in tactics, including the use of sophisticated malware and exploitation of legitimate web infrastructure, highlights the need for organizations to adopt proactive cybersecurity measures, such as timely patch management, employee training on social engineering tactics, and robust network monitoring to detect and mitigate such advanced persistent threats.
1 month ago
Kill Chain
Lazarus Group's Operation Dream Job: Exploiting Windows Zero-Day to Deploy 'Troy' Backdoor
In August 2026, the North Korean state-sponsored Lazarus Group exploited a zero-day vulnerability, CVE-2026-68820, in the Windows Ancillary Function Driver for WinSock (AFD.sys) to target defense and aerospace companies across France, Germany, Brazil, and India. Utilizing their 'Operation Dream Job' campaign, they lured professionals with fake job offers, leading victims to download malicious PDFs or trojanized PDF viewers. This method facilitated the deployment of a new backdoor named 'Troy,' granting the attackers remote access and control over compromised systems. The campaign's sophistication underscores the persistent threat posed by Lazarus Group to critical industries worldwide. This incident highlights the evolving tactics of nation-state actors in leveraging zero-day vulnerabilities combined with social engineering to infiltrate high-value targets. Organizations must remain vigilant, ensuring timely patching of vulnerabilities and educating employees about the risks of unsolicited job offers and phishing attempts.
1 month ago
Kill Chain
Citrix NetScaler CVE-2025-7775: Critical Vulnerability Exploited in the Wild
On August 26, 2025, Citrix disclosed a critical vulnerability (CVE-2025-7775) in NetScaler ADC and NetScaler Gateway products, which was actively exploited in the wild. This memory overflow flaw allows unauthenticated remote code execution and denial of service attacks on unpatched devices. The vulnerability affects versions 14.1 before 14.1-47.48, 13.1 before 13.1-59.22, 13.1-FIPS/NDcPP before 13.1-37.241-FIPS/NDcPP, and 12.1-FIPS/NDcPP up to 12.1-55.330-FIPS/NDcPP. Citrix released security updates to address this issue and urged immediate patching due to the lack of available mitigations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/citrix-fixes-critical-netscaler-rce-flaw-exploited-in-zero-day-attacks/amp/?utm_source=openai)) The active exploitation of CVE-2025-7775 underscores the persistent targeting of critical infrastructure by threat actors. Organizations relying on NetScaler products must prioritize patching to mitigate potential risks. This incident highlights the importance of timely vulnerability management and the need for robust security practices to defend against evolving cyber threats.
1 month ago
Kill Chain
Critical Vulnerability in NASA's cFS Health & Safety Application: CVE-2026-18064
In July 2026, a critical vulnerability (CVE-2026-18064) was identified in NASA's Core Flight System (cFS) Health & Safety (HS) Application versions up to 7.0.1. This flaw, stemming from an incomplete fix for a previous issue (CVE-2026-15352), allows attackers to trigger a NULL pointer dereference, leading to application crashes and potential denial-of-service conditions. The vulnerability affects systems worldwide, given cFS's deployment across various space missions. ([vulners.com](https://vulners.com/ics/ICSA-26-197-03?utm_source=openai)) This incident underscores the challenges in fully remediating software vulnerabilities and highlights the importance of thorough testing and validation processes. Organizations relying on cFS should prioritize updating to the latest software versions and implement robust monitoring to detect and mitigate potential exploitation attempts.
1 month ago
Kill Chain
Russian Hackers Exploit Exchange OWA Zero-Day (CVE-2026-42897)
In May 2026, the Russian state-sponsored hacking group Laundry Bear, also known as Void Blizzard, exploited a zero-day vulnerability (CVE-2026-42897) in Microsoft Exchange's Outlook Web Access (OWA). This cross-site scripting (XSS) flaw allowed attackers to execute arbitrary JavaScript in users' browsers by sending specially crafted emails. Upon opening these emails in OWA, the embedded malicious code executed, leading to the deployment of a sophisticated backdoor named OWAReaper. This malware enabled long-term access to victims' mailboxes, even after system restorations or credential changes. The campaign targeted various organizations, including government entities in the U.S. and Europe, as well as companies in the telecommunications, financial, hospitality, and aerospace sectors. The incident underscores the evolving tactics of state-sponsored threat actors and the critical need for organizations to promptly apply security patches and enhance email security measures. The exploitation of webmail platforms through XSS vulnerabilities highlights the importance of comprehensive security strategies to protect against sophisticated cyber espionage campaigns.
1 month ago
Kill Chain
Russian Hackers Exploit Microsoft OWA Vulnerability CVE-2026-42897
In July 2026, Russian state-sponsored threat actors, identified as Laundry Bear (also known as TA488 or Void Blizzard), exploited a cross-site scripting (XSS) vulnerability in Microsoft Outlook Web Access (OWA), designated as CVE-2026-42897. This flaw allowed attackers to execute arbitrary JavaScript code when a user opened a specially crafted email in OWA, leading to unauthorized access and data exfiltration. The campaign targeted U.S. and European government entities, as well as sectors including telecommunications, financial services, hospitality, and aerospace. This incident underscores a concerning trend of sophisticated, state-sponsored cyber attacks leveraging zero-day vulnerabilities to gain persistent access to critical systems. The rapid exploitation of such flaws highlights the urgent need for organizations to implement robust patch management processes and enhance their cybersecurity defenses to mitigate evolving threats.
1 month ago
Kill Chain
Mirage Kitten's New Malware Targets Middle East and Africa
In July 2026, the advanced persistent threat group Mirage Kitten, also known as UNC1549, Smoke Sandstorm, and Nimbus Manticore, launched a cyber-espionage campaign targeting aerospace, aviation, defense, and telecommunications sectors across the Middle East and Africa. Utilizing highly targeted spear-phishing campaigns and fake recruitment portals, they deployed a previously undocumented malware set, including the NightLedger backdoor and two WebSocket-based tunnelers, ArcBridge and BridgeHead, to gain persistent access and exfiltrate sensitive data. ([securelist.com](https://securelist.com/mirage-kitten-new-tools/120811/?utm_source=openai)) This incident underscores the evolving sophistication of APT groups in developing custom malware to infiltrate critical sectors. Organizations must enhance their cybersecurity measures to detect and mitigate such advanced threats, emphasizing the importance of proactive defense strategies in the face of persistent cyber-espionage activities.
1 month ago
Kill Chain
CubePilot's DNS Hijacking Incident: A Wake-Up Call for Cybersecurity
In July 2026, CubePilot, an Australian drone software developer, experienced a significant operational disruption due to a DNS hijacking attack. On July 24, attackers gained control over the DNS settings of cubepilot.org, redirecting user traffic to malicious servers. They also obtained TLS certificates for all subdomains, enabling them to intercept sensitive data, including user credentials entered on CubePilot's services. The company promptly regained control, revoked the fraudulent certificates, and initiated an investigation, advising users to change passwords if reused elsewhere. This incident underscores the escalating threat of DNS hijacking attacks targeting critical infrastructure and technology providers. Organizations must enhance their DNS security measures and monitor for unauthorized changes to prevent similar breaches.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports