Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Environmental Services

Breach intelligence, attack campaigns, and threat reports targeting the Environmental Services sector.

14 threat reports
Page 1 of 2
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Environmental Services Threat Reports

Showing 1–12 / 14 reports
TAG-193 Silent Lynx Espionage Campaign: How Zero Trust Could Have Protected Central Asian Governments
TAG-193 Silent Lynx Espionage Campaign: How Zero Trust Could Have Protected Central Asian Governments
Government Administration3 weeks ago

TAG-193 Silent Lynx Espionage Campaign: How Zero Trust Could Have Protected Central Asian Governments

TAG-193, also known as Silent Lynx and tracked as UAT-6275, conducted sustained cyber-espionage operations targeting government organizations across Central Asia and the Commonwealth of Independent States throughout 2024. The threat actor focused on diplomatic institutions, economic development agencies, and environmental policy organizations, leveraging evolving malware delivery techniques and expanded toolkits. The campaign demonstrated particular interest in water resources, forestry management, and regional infrastructure information with potential strategic value for negotiations and economic planning. Research by Cisco Talos and Recorded Future's Insikt Group revealed possible links to Kazakhstan, though the group's exact origins remain unclear. This incident highlights the growing trend of nation-state actors targeting regional governance and resource management data as geopolitical tensions increase around critical infrastructure and environmental policies in Central Asia.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
SpyCloud Exposes Massive Credential Theft Threatening U.S. Water Infrastructure
SpyCloud Exposes Massive Credential Theft Threatening U.S. Water Infrastructure
Utilities1 month ago

SpyCloud Exposes Massive Credential Theft Threatening U.S. Water Infrastructure

In December 2024, cybersecurity firm SpyCloud published research revealing that nearly 20% of U.S. water and wastewater organizations have identity data actively exposed through infostealer malware. The study analyzed 10,000 EPA-registered water systems and found 1,787 organizations with active credential exposure, including a critical supply chain incident where a single compromised device at a smart meter technology provider exposed login credentials for approximately 167 different utility companies. Attackers leveraging these stolen credentials can bypass multi-factor authentication through session hijacking and gain persistent access to corporate networks. This research comes amid heightened scrutiny of critical infrastructure security following multiple cyberattacks on water systems throughout 2024, with U.S. officials attributing many incidents to Iranian threat actors targeting operational technology systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical GeoNetwork Vulnerabilities Threaten 121 Government Geoportals Worldwide
Government Administration2 months ago

Critical GeoNetwork Vulnerabilities Threaten 121 Government Geoportals Worldwide

In July 2026, GeoNetwork, an open-source geospatial metadata catalog used by government agencies worldwide, patched two critical vulnerabilities that could be chained together for unauthenticated remote code execution. CVE-2026-63219 (CVSS 8.6) allows anonymous file uploads to the formatter directory, while CVE-2026-58400 (CVSS 9.1) enables malicious XSLT stylesheets to execute operating system commands through the Saxon transformation engine. Security researcher Rafael Castilho identified 121 exposed instances across 39 countries, with 89% belonging to government, military, or national agencies running the vulnerable software behind critical geoportal infrastructure. This incident highlights the growing targeting of geospatial infrastructure, following recent exploitation of GeoServer vulnerabilities for cryptocurrency mining and backdoor deployment. As governments increasingly digitize spatial data services and critical infrastructure mapping, these specialized systems present attractive targets for nation-state actors and cybercriminals seeking to compromise sensitive geographic intelligence.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cyberattacks Reveal Critical Vulnerabilities in U.S. Water Systems
Utilities3 months ago

Cyberattacks Reveal Critical Vulnerabilities in U.S. Water Systems

In late July 2026, a series of cyberattacks targeted water and wastewater systems across at least 12 U.S. states, including Michigan, South Dakota, and Georgia. Attackers exploited internet-exposed Rockwell Automation and Allen-Bradley programmable logic controllers (PLCs), specifically the MicroLogix 1100 and 1400 models, to remotely alter configurations, leading to operational disruptions such as pressure loss and flooding. Despite prior federal warnings, over 4,000 such controllers remained accessible online, with 2,844 located in the United States. This incident underscores the persistent vulnerabilities in critical infrastructure due to inadequate cybersecurity measures. The exploitation of known vulnerabilities in widely used industrial equipment highlights the urgent need for enhanced security protocols and the removal of operational technology from direct internet exposure to prevent future attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Iranian Cyberattacks Expose Vulnerabilities in U.S. Water Utilities
Utilities3 months ago

Iranian Cyberattacks Expose Vulnerabilities in U.S. Water Utilities

In late July 2026, a coordinated series of cyberattacks targeted over 30 community water systems across Minnesota, with similar incidents reported in at least 12 other states. The attackers, suspected to be Iranian-affiliated hackers, exploited vulnerabilities in internet-exposed programmable logic controllers (PLCs) that manage critical water infrastructure. These breaches led to operational disruptions, including temporary shutdowns of water treatment plants and manual operation shifts, though no contamination of drinking water was reported. ([techradar.com](https://www.techradar.com/pro/security/hackers-are-going-after-our-water-now-over-30-minnesota-utilities-hit-in-coordinated-cyberattack-by-apparent-iranian-attackers?utm_source=openai)) This incident underscores the escalating threat to U.S. critical infrastructure from state-sponsored cyber actors. The attacks highlight systemic vulnerabilities in aging water systems, many of which lack adequate cybersecurity measures. The urgency for enhanced security protocols and infrastructure investment is paramount to prevent future disruptions and safeguard public health.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
CISA Issues Alert on Iranian Cyber Actors Targeting U.S. Critical Infrastructure PLCs
Utilities3 months ago

CISA Issues Alert on Iranian Cyber Actors Targeting U.S. Critical Infrastructure PLCs

In July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert regarding Iranian-affiliated cyber actors targeting internet-connected programmable logic controllers (PLCs) within U.S. critical infrastructure sectors, including water and wastewater systems. These actors exploited vulnerabilities in PLCs from manufacturers such as Rockwell Automation, Schneider Electric, and Siemens, leading to operational disruptions and financial losses. The attackers manipulated data on human-machine interfaces (HMIs) and supervisory control and data acquisition (SCADA) displays, causing outages and misleading operators about system statuses. This incident underscores the escalating threat landscape where state-sponsored actors are increasingly focusing on industrial control systems. The expansion of targeted PLC brands highlights the need for organizations to reassess and fortify their operational technology (OT) security measures to prevent potential disruptions to essential services.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Minnesota Water Utilities Face Coordinated Cyberattacks in July 2026
Utilities3 months ago

Minnesota Water Utilities Face Coordinated Cyberattacks in July 2026

In late July 2026, over 30 community water systems in Minnesota experienced a coordinated cyberattack targeting their operational technology (OT) systems. The attacks, occurring on July 26 and 27, led to temporary disruptions in water treatment and distribution processes. For instance, the City of Braham reported its water plant was taken offline due to a malicious cyberattack but managed to restore operations within hours. The Minnesota IT Services (MNIT) agency activated its cybersecurity incident response capabilities, collaborating with federal, state, local, Tribal, and private-sector partners to investigate and mitigate the incident. This incident underscores the escalating threats to critical infrastructure, particularly in the water sector. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has emphasized the importance of isolating key OT systems to ensure continuity of critical services during cyberattacks. ([cyber.gov.au](https://www.cyber.gov.au/business-government/secure-design/operational-technology-environments/ci-fortify/ci-fortify-advice-for-isolating-vital-systems?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Coordinated Cyberattack Disrupts 30+ Minnesota Water Systems
Utilities3 months ago

Coordinated Cyberattack Disrupts 30+ Minnesota Water Systems

In late July 2026, a coordinated cyberattack targeted operational technology at over 30 community water systems across Minnesota, leading to service disruptions in cities including Braham, Plymouth, South St. Paul, and Maple Plain. The attacks affected automated controls and communications, with Braham's water plant temporarily going offline. State and federal agencies, including Minnesota IT Services (MNIT), the Cybersecurity and Infrastructure Security Agency (CISA), and the Environmental Protection Agency (EPA), initiated a comprehensive response to contain the incidents and restore services. The attackers' methods and identities remain under investigation, with no confirmed attribution to date. This incident underscores the escalating threat to critical infrastructure, particularly water systems, from cyberattacks. The similarities between this attack and previous campaigns targeting industrial control systems highlight the urgent need for enhanced cybersecurity measures and vigilance in protecting essential services.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
ZionSiphon Malware: A New Threat to Israeli Water Infrastructure
Utilities6 months ago

ZionSiphon Malware: A New Threat to Israeli Water Infrastructure

In April 2026, cybersecurity researchers identified a new malware strain named ZionSiphon, specifically engineered to target Israeli water treatment and desalination systems. The malware exhibits capabilities such as establishing persistence, modifying local configuration files, and scanning for operational technology (OT) services within local networks. Notably, ZionSiphon is designed to operate exclusively within Israeli IP address ranges and targets processes associated with water treatment operations, including chlorine dosing and pressure control systems. While the current version contains a flaw that prevents full execution, its architecture indicates a significant advancement in OT-targeted cyber threats. ([thehackernews.com](https://thehackernews.com/2026/04/researchers-detect-zionsiphon-malware.html?utm_source=openai)) This discovery underscores a growing trend of politically motivated cyberattacks aimed at critical infrastructure. The emergence of ZionSiphon highlights the increasing sophistication of threats targeting OT environments, emphasizing the need for enhanced security measures to protect essential services from potential sabotage.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Iranian APT Exploits PLC Vulnerabilities in U.S. Critical Infrastructure
Utilities7 months ago

Iranian APT Exploits PLC Vulnerabilities in U.S. Critical Infrastructure

In April 2026, Iranian-affiliated advanced persistent threat (APT) actors targeted internet-facing operational technology (OT) devices, specifically programmable logic controllers (PLCs) manufactured by Rockwell Automation/Allen-Bradley, across multiple U.S. critical infrastructure sectors. These attacks led to disruptions in energy, water, and government facilities by manipulating project files and tampering with human-machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruptions and financial losses. ([databreaches.net](https://databreaches.net/2026/04/07/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical-infrastructure/?utm_source=openai)) This incident underscores the escalating cyber threats from nation-state actors targeting critical infrastructure, highlighting the urgent need for enhanced cybersecurity measures and vigilance in protecting OT environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Iranian APT Exploits U.S. Critical Infrastructure PLCs in 2026
Utilities7 months ago

Iranian APT Exploits U.S. Critical Infrastructure PLCs in 2026

In April 2026, Iranian-affiliated advanced persistent threat (APT) actors exploited internet-facing operational technology (OT) devices, notably Rockwell Automation/Allen-Bradley programmable logic controllers (PLCs), across multiple U.S. critical infrastructure sectors. The attackers accessed these devices via default or weak credentials, leading to disruptions through malicious interactions with project files and manipulation of data on human-machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruptions and financial losses. ([publicpower.org](https://www.publicpower.org/periodical/article/iranian-affiliated-cyber-actors-exploit-programmable-logic-controllers-across-us-critical?utm_source=openai)) This incident underscores the escalating threat posed by nation-state actors targeting critical infrastructure. The exploitation of OT devices highlights the urgent need for organizations to secure internet-facing systems, implement strong authentication measures, and regularly update and patch their systems to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ransomware Attack Hits Romanian Water Authority: A 2024 Critical Infrastructure Wake-Up Call
Utilities10 months ago

Ransomware Attack Hits Romanian Water Authority: A 2024 Critical Infrastructure Wake-Up Call

In June 2024, Romania’s National Water Administration (Administrația Națională Apele Române) suffered a ransomware attack that disrupted key systems and operational processes. The attack, identified over the weekend of June 8–9, targeted core IT infrastructure, encrypting file servers and temporarily interrupting the administrative management of the country’s water resources. While water supply to the public reportedly remained unaffected, the incident led to delays in critical public and environmental services and highlighted gaps in incident response capabilities and network segmentation. Early indications suggest the attackers used a known ransomware variant, gaining access via a vulnerable remote service. This breach comes amid a surge in ransomware attacks on public utilities across Europe, emphasizing the increasing threat to operational technology and critical infrastructure. Heightened regulatory scrutiny and an evolving threat landscape put additional pressure on agencies to improve cyber resilience and visibility.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports