Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Industrial Automation

Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.

298 threat reports
Page 1 of 25
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Industrial Automation Threat Reports

Showing 1–12 / 298 reports
CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks
CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks
Oil/Energy/Solar/Greentech3 days ago

CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks

In November 2026, CISA published ICS Advisory ICSA-26-307-01 disclosing two critical vulnerabilities (CVE-2026-63017 and CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center, an industrial control system platform widely deployed in critical manufacturing and energy sectors worldwide. CVE-2026-63017, rated CVSS 9.4, allows a low-privileged authenticated user to access administrator-restricted resources via incorrect authorization (CWE-863). CVE-2026-63774, also rated CVSS 9.4, enables authenticated users to execute unauthorized SQL commands through the report designer due to insufficient input validation (CWE-89). Both vulnerabilities require adjacent network access and affect versions spanning the 2020, 2024, and 2026 product lines. Successful exploitation could expose sensitive operational data, manipulate ICS database records, and disrupt energy grid management functions. These vulnerabilities are significant because they target ICS/OT environments in energy and critical manufacturing—sectors already under elevated threat from nation-state and ransomware actors. The combination of privilege escalation and SQL injection within a single OT platform dramatically lowers the bar for insider threats and lateral movement, reflecting a broader trend of attackers targeting operational technology management layers rather than field devices alone.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes
CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes
Industrial Automation6 days ago

CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes

In late October 2026, active exploitation of CVE-2026-58115 (CVSS 10.0) was confirmed against Siemens SIMATIC IoT2050 Advanced devices running Node-RED. Unauthenticated remote attackers delivered multi-stage payloads via malicious Node-RED flows, using wget and curl to pull Linux botnet binaries from attacker-controlled servers at 85.215.73[.]250 and 45.194.90[.]57. Implants were disguised as kernel worker threads and stored in memory-backed paths to evade detection. A persistent HTTP backdoor endpoint was also installed, enabling arbitrary command execution even after reboots wiped in-memory implants, compromising operational technology environments at maximum privilege. This incident underscores an accelerating threat to OT and industrial IoT infrastructure, where legacy authentication gaps and internet-exposed management interfaces continue to be weaponized. As critical infrastructure sectors face increasing regulatory scrutiny under frameworks such as NIST CSF 2.0 and IEC 62443, the exploitation of unauthenticated remote code execution vulnerabilities in industrial devices signals a dangerous convergence of IT and OT attack surfaces.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
Hackers Turned Up the Heat: How Europe's Supermarket Fridges Became an ICS/OT Battleground
Hackers Turned Up the Heat: How Europe's Supermarket Fridges Became an ICS/OT Battleground
Supermarkets6 days ago

Hackers Turned Up the Heat: How Europe's Supermarket Fridges Became an ICS/OT Battleground

In the early hours of November 2, 2026, threat actors remotely manipulated industrial refrigeration controllers across supermarkets in Belgium, Sweden, Estonia, Ireland, the Netherlands, Finland, Portugal, and Italy. Attackers exploited internet-exposed Danfoss AK-SM and AK-SC series controllers—many running outdated firmware with default credentials and no VPN protection—switching units into defrost mode or raising setpoints to 50°C. Dozens of stores across chains including Delhaize, Carrefour, ICA, Coop, and SuperValu were forced to discard or pull chilled and frozen goods, with one Belgian butcher estimating €15,000 in losses. The attack mirrored a nearly identical campaign against hundreds of French supermarkets three weeks prior. This second wave confirms that ICS/OT attacks on retail cold-chain infrastructure are becoming a repeatable, scalable playbook. Attackers require no sophisticated zero-day—only internet-exposed legacy controllers with default passwords. As regulators across the EU accelerate NIS2 enforcement and critical-infrastructure owners expand OT connectivity, the window for unprotected industrial devices to be weaponized for economic disruption is widening rapidly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges
LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges
Financial Services6 days ago

LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges

In 2026, Google Threat Intelligence Group and Mandiant documented a surge in LLMjacking attacks targeting enterprises across financial services, retail, technology, and transportation sectors in North America, South America, and Asia Pacific. Threat actors—including the tracked cluster UNC6993—obtained cloud credentials via phishing, misconfigured Service Account keys, exposed GitHub Personal Access Tokens, and public code repositories to gain unauthorized access to enterprise LLM APIs. After establishing a foothold, attackers escalated privileges, performed multi-region reconnaissance, cloned codebases for hard-coded secrets, and created backdoor service accounts. Fraudulent LLM consumption exceeded $100,000 USD in a single day at individual organizations, with cumulative charges reaching $1 million USD before access was revoked. LLMjacking represents a structural evolution beyond cryptojacking, exploiting the high per-token cost of frontier AI models and the emergence of underground LLM Mixer services that proxy and resell stolen enterprise LLM access. As agentic AI workflows proliferate in production cloud environments, the attack surface for credential-based API abuse is expanding rapidly, making cloud identity hygiene and real-time egress enforcement urgent priorities for security teams in 2026 and beyond.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Cold Chain Under Attack: How Hackers Shut Down Refrigerators Across Europe's Supermarkets
Cold Chain Under Attack: How Hackers Shut Down Refrigerators Across Europe's Supermarkets
Supermarkets6 days ago

Cold Chain Under Attack: How Hackers Shut Down Refrigerators Across Europe's Supermarkets

In November 2026, threat actors remotely exploited vulnerabilities in industrial refrigeration controllers—specifically Danfoss AK-SM/AK-SC and Copeland/Dixell XWEB units—to manipulate temperature settings across more than 115 supermarket locations in Belgium, the Netherlands, Sweden, Luxembourg, Ireland, and Estonia. Attackers activated defrost functions and raised freezer temperatures to as high as +50°C overnight, forcing emergency food disposal and the deployment of refrigerated trucks. Over a dozen retail chains were impacted, including Ahold Delhaize, Carrefour, Coop, ICA, and SuperValu. The attack vector was attributed to the same unpatched vulnerability exploited in a comparable campaign targeting French supermarkets the prior month, with refrigeration vendor Sabcobel identified as a common technology supplier across affected sites. This incident follows a documented escalation in ICS/OT-targeted attacks against civilian critical infrastructure—specifically cold-chain and food-retail systems. As operational technology converges with internet-connected management platforms, the attack surface for remote exploitation expands dramatically, and the consequences move beyond data loss into tangible physical and economic harm.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Hitachi Energy TRO600 Exposed: Unauthenticated File Read and Port-Forwarding Bypass Threaten Energy Grid ICS Devices
Hitachi Energy TRO600 Exposed: Unauthenticated File Read and Port-Forwarding Bypass Threaten Energy Grid ICS Devices
Oil/Energy/Solar/Greentech1 week ago

Hitachi Energy TRO600 Exposed: Unauthenticated File Read and Port-Forwarding Bypass Threaten Energy Grid ICS Devices

In October 2026, CISA republished a Hitachi Energy PSIRT advisory disclosing two high-severity vulnerabilities in the TRO600 series of industrial communication products deployed globally across energy-sector critical infrastructure. CVE-2026-10756 (CVSS 3.1: 7.5) allows an authenticated attacker to abuse port-forwarding to bypass network access restrictions and reach localhost-bound services, enabling unauthorized access to sensitive functionality and confidential data. CVE-2026-106087 (CVSS 4.0: 8.7) is an unauthenticated arbitrary file read flaw that exposes configuration files and credential data without any prior authentication, creating a direct path to credential harvesting and follow-on compromise. Hitachi Energy recommends immediate upgrade to version 9.2.2.1. These vulnerabilities are significant because TRO600 devices sit at the operational technology edge of energy grids and substations worldwide. The combination of an unauthenticated file-read and an authenticated lateral-access bypass mirrors the attack chain patterns observed in recent state-sponsored campaigns targeting energy infrastructure, reinforcing the urgency of ICS/OT network segmentation and encrypted-traffic enforcement.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Hitachi Energy CoreTec Under Fire: Chained OS Command Injection and Kernel Privilege Escalation Threaten Global Energy OT Infrastructure
Hitachi Energy CoreTec Under Fire: Chained OS Command Injection and Kernel Privilege Escalation Threaten Global Energy OT Infrastructure
Oil/Energy/Solar/Greentech1 week ago

Hitachi Energy CoreTec Under Fire: Chained OS Command Injection and Kernel Privilege Escalation Threaten Global Energy OT Infrastructure

In October 2026, CISA published ICS Advisory ICSA-26-302-03 disclosing two high-severity vulnerabilities in Hitachi Energy's CoreTec4 and CoreTec5 industrial cybersecurity appliances, which are widely deployed in global energy infrastructure. CVE-2026-13162 (CVSS 7.5) is an OS command injection flaw in the configuration daemon's timezone handler that allows an authenticated low-privileged user to execute arbitrary system commands with full device control. CVE-2026-43284 (CVSS 8.8) is a Linux kernel IPsec ESP subsystem write-what-where flaw enabling local privilege escalation to root by crafting malicious ESP packets that overwrite privileged OS binaries in memory. Both vulnerabilities affect CoreTec versions 3.4.0 and prior, with remediation requiring upgrade to CoreTec5 version 5.0.0. These disclosures arrive as threat actors, including nation-state groups, intensify targeting of operational technology environments in the energy sector. The combination of an authenticated remote command injection and a kernel-level privilege escalation in a single OT security appliance creates a chained exploitation path that could grant adversaries persistent root access to devices governing critical energy systems, elevating risk across the entire OT kill chain.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SAML Replay in Siemens Mendix: How CVE-2026-89209 Lets Attackers Walk In Without a Password
SAML Replay in Siemens Mendix: How CVE-2026-89209 Lets Attackers Walk In Without a Password
Information Technology/IT1 week ago

SAML Replay in Siemens Mendix: How CVE-2026-89209 Lets Attackers Walk In Without a Password

In October 2026, CISA republished a Siemens ProductCERT advisory (ICSA-26-302-01 / SSA-137528) disclosing a critical authentication bypass vulnerability—CVE-2026-89209—in the Mendix SAML module across Mendix 9, 10, and 11 compatible versions. The flaw, classified as CWE-294 (Authentication Bypass by Capture-Replay), allows an unauthenticated remote attacker to replay a previously captured valid SAML assertion within IdP-initiated SSO flows, thereby gaining unauthorized application access without valid credentials. Affected versions include Mendix SAML below v4.2.4 (Mendix 10/11) and below v3.6.29 (Mendix 9). Siemens released patched versions and recommended disabling IdP-initiated SSO as an interim mitigation. The vulnerability carries a CVSS v3.1 base score of 6.8 (Medium), with high confidentiality and integrity impact. SAML replay attacks against low-code and enterprise application platforms are an increasingly favored initial access technique, as they exploit trust relationships between identity providers and service providers rather than brute-forcing credentials. With Mendix widely deployed across critical manufacturing and IT sectors globally, this disclosure underscores the growing risk surface introduced by federated identity in operational technology and enterprise software environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Hundreds of Millions of Devices at Risk: GoAhead TLS Flaws Let Revoked Certificates Pass and Sessions Be Decrypted
Hundreds of Millions of Devices at Risk: GoAhead TLS Flaws Let Revoked Certificates Pass and Sessions Be Decrypted
Computer Networking1 week ago

Hundreds of Millions of Devices at Risk: GoAhead TLS Flaws Let Revoked Certificates Pass and Sessions Be Decrypted

In October 2026, security researcher Sébastien Féry of FoxIO disclosed three TLS vulnerabilities in the GoAhead embedded web server, which runs in hundreds of millions of routers, printers, industrial controllers, and gateways from vendors including HP, Siemens, Rockwell, Canon, and D-Link. The most critical flaw, CVE-2026-115881 (rated 9.1), allows a revoked client certificate to complete mutual-TLS authentication because GoAhead's OpenSSL backend loads a certificate revocation list at startup but never enforces it. A second flaw permits over-length certificate chains to bypass authentication on LibreSSL legacy builds, and a third causes a 1-byte Diffie-Hellman value to be transmitted over Mbed TLS, enabling passive session decryption. Fix version 6.1.1 was released August 2, 2026, but device owners depend entirely on individual manufacturers to ship firmware updates. These flaws expose a systemic firmware supply-chain risk: the attack surface is determined at compile time, invisible to device owners, and remediation velocity is controlled by OEM manufacturers rather than the software vendor. As embedded systems increasingly anchor industrial and enterprise network edges, unpatched TLS flaws in shared components like GoAhead represent a durable, low-noise pathway for credential bypass and traffic interception that persists until each OEM ships and deploys a firmware update.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AI-Executed Ransomware: Inside the Phantom Framework That Automated Intrusions Across 62 Organizations
AI-Executed Ransomware: Inside the Phantom Framework That Automated Intrusions Across 62 Organizations
Industrial Automation2 weeks ago

AI-Executed Ransomware: Inside the Phantom Framework That Automated Intrusions Across 62 Organizations

In October 2026, cybersecurity researchers at SOCRadar exposed a sophisticated AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. The operation centered on an autonomous framework called Phantom, which used OpenCode and commercial AI models via OpenRouter to execute human-approved but AI-automated kill chains. Attackers exploited edge devices including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways using multiple CVEs, then moved laterally, harvested credentials, and exfiltrated sensitive data via reverse-SOCKS tunnels before deploying ransomware. Approximately 62 organizations were targeted, with over 50% based in the United States, primarily across industrial, manufacturing, energy, healthcare, and pharmaceutical sectors. This incident signals a structural shift in the ransomware threat landscape: AI agents are now operationalizing intrusion playbooks at machine speed while keeping humans in an approver role. The use of WormGPT-MCP, Ghost C2, and AI-curated victim knowledge bases indicates that agentic AI is rapidly becoming a standard component of ransomware-as-a-service toolkits, compressing attacker timelines and raising the bar for enterprise defenders.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Frozen Out: How Unpatched Fridge Firmware Burned 700 European Supermarkets
Frozen Out: How Unpatched Fridge Firmware Burned 700 European Supermarkets
Supermarkets2 weeks ago

Frozen Out: How Unpatched Fridge Firmware Burned 700 European Supermarkets

In October 2026, attackers exploited unpatched firmware vulnerabilities in commercial refrigeration controllers — specifically CVE-2025-41450, CVE-2025-41451, and CVE-2025-41452 in Danfoss AK-SM 800A, as well as 23 flaws in Dixell/Copeland XWEB Pro — to sabotage refrigeration systems across more than 700 European grocery stores in a single night. Threat actors gained remote access via third-party service providers managing legacy OT equipment, manipulated defrost cycles to disguise the attack as routine maintenance, and forced temperatures above 50°C, destroying perishable inventory and triggering minor fires. Intermarché alone reported tens of millions of euros in losses, with impacts spanning France, Spain, Portugal, Poland, Germany, and Belgium. Attackers accessed systems through unmonitored third-party OT vendor connections on internet-exposed controllers running end-of-life firmware dating to 2016. This incident signals a sharp escalation in ICS/OT sabotage targeting civilian food infrastructure. With thousands of Danfoss systems still internet-exposed and researchers having published exploit details just weeks before the attack, the gap between vulnerability disclosure and weaponization is closing dangerously fast — raising urgent questions about third-party OT access governance across critical supply chains.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Plex2Shell: How Attackers Chained Four CVEs Into a 9.8 Critical RCE—and What It Means for Your Cloud Security Posture
Plex2Shell: How Attackers Chained Four CVEs Into a 9.8 Critical RCE—and What It Means for Your Cloud Security Posture
Information Technology/IT2 weeks ago

Plex2Shell: How Attackers Chained Four CVEs Into a 9.8 Critical RCE—and What It Means for Your Cloud Security Posture

In October 2026, CISA issued an urgent advisory warning that threat actors were actively chaining four vulnerabilities in Plex Media Server—collectively dubbed Plex2Shell—to achieve unauthenticated remote code execution on exposed servers. The exploit chain, assigned a critical CVSS score of 9.8, begins with an unauthenticated SSRF flaw (CVE-2026-96652) that allows attackers to reach internal APIs, progresses through a URL injection flaw (CVE-2026-96654) to invoke plugin functions, escalates via an authenticated SSRF (CVE-2026-96655), and culminates in arbitrary file write (CVE-2026-96656) to plant malicious shared libraries. Active exploitation was observed as early as October 17, 2026, initially targeting honeypots to deploy cryptominers. Federal agencies were directed to patch or mitigate by October 23, 2026. Plex2Shell illustrates the accelerating trend of researchers publishing full exploit chains and PoC code within days of responsible disclosure, dramatically compressing the window between public knowledge and mass exploitation. With over 36,000 Plex servers estimated to be internet-exposed, chained CVE attacks against consumer-grade media infrastructure highlight how attacker tooling now commoditizes multi-stage exploits for rapid, widespread campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports