✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
Critical Authorization Bypass Hits Siemens Industrial Edge in 2026
In January 2026, Siemens disclosed a critical vulnerability (CVE-2025-40805) affecting the Industrial Edge Device Kit line for both arm64 and x86-64 architectures. The flaw, present in numerous firmware versions, allows unauthenticated remote attackers to bypass user authentication on specific API endpoints by exploiting an authorization weakness. An attacker who learns a legitimate user’s identity could leverage this to impersonate that user and gain illicit control or visibility within industrial environments. Siemens promptly released security updates and mitigation guidance for impacted devices, urging organizations to update or restrict network access as a preventive measure. This incident highlights increasing risks to operational technology (OT) and critical infrastructure, as authentication flaws in widely deployed industrial solutions can expose factories and utilities globally. The CVE underscores growing threats facing manufacturing, regulatory pressure for timely patching, and ongoing urgency for zero trust controls in industrial systems.
6 months ago
Kill Chain
Siemens 2026: Denial-of-Service Flaw Impacts SIMATIC & SIPLUS ICS Devices
In January 2026, Siemens publicly disclosed a denial-of-service vulnerability (CVE-2025-40944) impacting multiple SIMATIC and SIPLUS products used widely in critical manufacturing environments. The flaw allows an attacker to send a specially crafted S7 protocol Disconnect Request (COTP DR TPDU) over TCP port 102, which causes affected devices to become unresponsive, requiring a physical power cycle to restore service. While some products have received security updates, many still await permanent fixes. Incident response measures include network segmentation and port filtering to mitigate risk, as exploitation could disrupt operational technology and industrial control systems worldwide. This incident is especially relevant amid the ongoing focus on industrial cyber defenses, as threat actors increasingly target operational technology. The vulnerability highlights persistent risks from protocol weaknesses and layered third-party supply chains, underscoring the importance of proactive risk management, segmentation, and maintaining up-to-date mitigations in ICS environments.
6 months ago
Kill Chain
Delta PLC Vulnerabilities: How 2024’s Critical Flaws Put Industrial Operations at Risk
In June 2024, security researchers publicly disclosed three critical vulnerabilities in Delta Electronics' industrial PLC (Programmable Logic Controller) products, which are widely used across global manufacturing, energy, and automation sectors. These flaws allow remote attackers to bypass authentication, execute arbitrary code, and disrupt operational processes if exploited. While no in-the-wild attacks have been reported to date, the vulnerabilities could grant adversaries broad control over industrial systems and potentially lead to industrial sabotage or production halts. Delta Electronics has released security patches and advisories to help customers mitigate risks. This disclosure is significant because ICS-targeted attacks have increased in sophistication and frequency, exposing the strategic risks of legacy and industrial devices. Critical infrastructure organizations face urgent pressure to update and segment exposed controllers, reinforcing the necessity for real-time threat detection and Zero Trust policies to thwart emerging OT threats.
6 months ago
Kill Chain
Rockwell Automation ICS Devices Exposed by Critical DoS Vulnerability (CVE-2025-9368)
In January 2026, Rockwell Automation disclosed a critical vulnerability (CVE-2025-9368) affecting its 432ES-IG3 Series A industrial Ethernet/IP interface. The flaw, classified as a resource allocation vulnerability (CWE-770), can be exploited remotely to cause a denial-of-service (DoS) condition, rendering the device unresponsive and requiring manual power cycling to restore operations. The vulnerability affects version V1.001 of the device, widely deployed in critical manufacturing environments worldwide. No evidence of active exploitation has been reported as of the initial CISA advisory, but the risk of service disruption in operational technology (OT) networks is significant. This incident underscores the persistent threat posed by resource exhaustion flaws in industrial control systems, as attackers continue to seek low-complexity, high-impact vulnerabilities to disrupt critical infrastructure. With global regulatory focus increasing and ICS-targeted attacks on the rise, addressing resource and availability issues has become a pressing operational and compliance priority for manufacturers and critical infrastructure operators.
6 months ago
Kill Chain
Rockwell Automation DataMosaix SQL Injection Exposes Critical Manufacturing Systems
In January 2026, Rockwell Automation disclosed a critical vulnerability in its FactoryTalk DataMosaix Private Cloud platform affecting versions 7.11, 8.00, and 8.01. Identified as CVE-2025-12807, this SQL Injection flaw allows low-privilege users to execute unauthorized sensitive database operations through exposed API endpoints. While no public exploitation has been reported, successful attacks could significantly compromise critical manufacturing infrastructure worldwide by enabling attackers to access or manipulate sensitive industrial data. The incident highlights ongoing risks to industrial control environments from common vulnerabilities like SQL Injection, especially in products globally deployed across critical infrastructure sectors. With attackers increasingly targeting OT platforms, organizations face renewed urgency to review security controls and ensure compliance with updated defensive best practices.
6 months ago
Kill Chain
Critical RCE Flaw in Hitachi Energy Asset Suite: Jasper Report Vulnerability Exposes Critical Infrastructure (2025)
In December 2025, Hitachi Energy disclosed a critical remote code execution (RCE) vulnerability (CVE-2025-10492) affecting its Asset Suite product versions 9.7 and prior. The flaw, found in the Jasper Report third-party component, arises from improper deserialization of untrusted data, allowing attackers to remotely execute arbitrary code on affected systems. The vulnerability particularly impacts organizations using Asset Suite in critical infrastructure sectors, such as energy, potentially exposing operational networks to severe risks of compromise, data breach, or service disruption. This incident underscores the persistent threat posed by supply chain vulnerabilities in industrial control software. As threat actors increasingly target critical infrastructure through third-party and open-source components, organizations face heightened regulatory scrutiny and an urgent need for robust patch and mitigation strategies to close compliance and security gaps.
6 months ago
Kill Chain
27 Malicious npm Packages Turn Dev Ecosystem Into Phishing Playground in 2025
In late 2025, security researchers uncovered a sophisticated supply chain attack leveraging the npm package ecosystem to execute a targeted spear-phishing campaign. Over a five-month period, attackers published 27 malicious npm packages via six aliases, using content delivery networks to host and serve browser-based phishing lures. These lures mimicked document-sharing and Microsoft sign-in portals to trick targeted sales and commercial staff at 25 organizations across manufacturing, industrial automation, healthcare, and allied sectors in the US and Europe. The campaign incorporated advanced anti-analysis checks, obfuscated JavaScript, and honeypot detection to evade security tooling, with hardcoded targets likely sourced from trade show and open-sourced company data. This incident exemplifies the growing abuse of public developer ecosystems and infrastructure in credential theft operations, highlighting an urgent need for organizations to monitor software supply chains and enforce modern, phishing-resistant controls. Attackers' use of legitimate distribution services as resilient hosting and focus on regional, non-IT staff illustrate shifting tactics in supply chain and social engineering threats.
6 months ago
Kill Chain
ICS in Crisis: Multi-Vector Malware Campaign Hits Industrial Automation Sector in Q3 2025
In Q3 2025, a coordinated multi-vector malware campaign targeted the global industrial automation sector, exploiting both internet-borne and lateral movement vectors to infiltrate sensitive OT environments. Malicious scripts, phishing pages, and spyware were delivered through malicious emails and compromised websites, with attackers leveraging old vulnerabilities in software such as Microsoft Office Equation Editor (CVE-2017-11882) to gain persistent access. The incident impacted biometrics, engineering, and manufacturing industries, affecting up to 27.4% of ICS computers in certain regions, and enabled the delivery of ransomware, spyware, and self-propagating worms across distributed networks. This incident is notable for its breadth—over 11,000 malware families were detected—and its use of diverse channels, from web to USB to network shares. The surge in initial infection via malicious scripts and documents, especially in East Asia and South America, demonstrates attackers’ evolving tactics and the urgent need for improved segmentation, encrypted network traffic, and anomaly detection across critical OT environments.
6 months ago
Kill Chain
Mitsubishi Electric ICS Flaw in 2025 Highlights Need for Encrypted Traffic
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released an advisory detailing a critical vulnerability affecting Mitsubishi Electric Air Conditioning Systems that are widely deployed in industrial environments. The issue, cataloged as ICSA-25-177-01, centers on insufficient encryption for industrial control system (ICS) communications, exposing unencrypted traffic that could be intercepted and manipulated by malicious actors. If exploited, this vulnerability could enable attackers to intercept sensitive data or issue unauthorized commands to affected ICS devices, putting essential infrastructure operations at risk. Immediate mitigation steps were recommended for organizations to safeguard operational technology environments and prevent exploitation. This incident draws attention to the persistent risks of unencrypted or poorly protected network traffic within legacy ICS deployments. As digital transformation accelerates and threat actors increasingly target critical infrastructure, robust encrypted traffic solutions and segmentation controls are vital to ensure compliance and operational resilience.
6 months ago
Kill Chain
CISA Flags Critical ICS Flaws Threatening National Infrastructure in 2025
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released nine advisories covering serious vulnerabilities discovered in multiple industrial control systems (ICS) from vendors including Inductive Automation, Schneider Electric, Siemens, Mitsubishi Electric, Advantech, National Instruments, Rockwell Automation, and Axis Communications. These vulnerabilities potentially allow attackers to gain unauthorized access, move laterally, and disrupt or manipulate key operations in sectors such as energy, manufacturing, and transportation. Many of the issues arise from insecure configurations, insufficient encryption, outdated software components, and lack of segmentation between critical assets. This incident highlights the alarming persistence of security gaps across ICS environments. As operational technology (OT) converges with IT, attackers increasingly exploit these systems to launch ransomware, disrupt supply chains, or conduct cyber-physical sabotage, emphasizing the urgent need for robust controls, patching, and increased network visibility in critical infrastructure.
6 months ago
Kill Chain
Critical OS Command Injection Vulnerability Hits Mitsubishi Electric Iconics Products (2025)
In December 2025, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products disclosed a critical vulnerability (CVE-2025-11774) affecting GENESIS64, ICONICS Suite, MobileHMI, and MC Works64 software. This OS command injection flaw resides in the software keyboard (keypad) function, enabling local attackers to execute arbitrary executable files (.EXE) by tampering with configuration files. If successfully exploited, adversaries could trigger denial-of-service (DoS), information tampering, and unauthorized information disclosure or destruction on systems running these products. A fix is available for most products by upgrading to GENESIS64 v10.97.3 or higher, but MC Works64 users must migrate as no patch is planned. The incident is significant for the critical manufacturing sector, highlighting persistent risks tied to ICS software supply chains. As attackers increasingly exploit software flaws in operational technology, prompt patching and network segmentation remain vital. This vulnerability’s disclosure underscores the necessity for maintaining robust controls on critical infrastructure endpoints and monitoring for lateral movement threats.
6 months ago
Kill Chain
Rockwell Automation PLC Flaws Put Industrial Control Systems at Risk in 2025
In December 2025, Rockwell Automation disclosed multiple vulnerabilities affecting its Micro820, Micro850, and Micro870 programmable logic controllers (PLCs). The most critical issues (CVE-2025-13823, CVE-2025-13824) were found in the IPv6 stack and improper handling of malformed CIP packets, potentially allowing unauthenticated attackers to cause denial-of-service conditions. Successful exploitation could lead to systems becoming unresponsive and requiring physical intervention to restore operation. Affected product versions are widely deployed across critical manufacturing sectors worldwide, increasing the risk of operational disruptions. This incident highlights the growing exposure of operational technology (OT) devices to network-borne threats and the importance of promptly securing ICS environments. The prevalence of fuzzing-based vulnerability discovery and dependency on third-party components heighten the urgency to apply vendor-recommended mitigations and adopt defense-in-depth strategies.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports