✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Industrial Automation
Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.
Explore Other Sectors
Industrial Automation Threat Reports
Critical AutomationDirect PLC Vulnerabilities Expose Manufacturing to Cyber Risk in 2025
In October 2025, AutomationDirect disclosed multiple critical vulnerabilities affecting its Productivity Suite and a range of Productivity 1000, 2000, and 3000 PLC models, widely deployed in the manufacturing sector. Discovered by Nozomi Networks, the flaws—such as remote code execution, weak password recovery, and unrestricted file system access—could allow unauthenticated attackers to gain full control of affected devices, compromise sensitive project files, and disrupt industrial processes. The vulnerabilities could be exploited remotely with low attack complexity and no user interaction. This incident highlights rising risks posed by legacy and poorly segmented OT networks, as threat actors increasingly target industrial control systems. The sharp jump in the number and severity of disclosed PLC software vulnerabilities underscores the urgent need for enhanced segmentation, access controls, and monitoring in critical infrastructure environments.
6 months ago
Kill Chain
CISA Raises Alarm on Schneider Electric & Vertikal ICS Vulnerabilities (2025)
In October 2025, CISA released urgent advisories for three significant industrial control system (ICS) vulnerabilities affecting Schneider Electric EcoStruxure, Vertikal Systems Hospital Manager Backend Services, and Schneider Electric Modicon. The vulnerabilities, discovered through active monitoring and intelligence efforts, could allow unauthorized access, system manipulation, or disruption if exploited by threat actors. These issues expose critical infrastructure, including healthcare and industrial automation environments, to increased risk of cyberattacks that could impact operations, safety, and patient care. CISA highlighted immediate mitigations and urged organizations to review and apply them to safeguard their assets. The frequency of high-severity ICS vulnerabilities underscores an ongoing trend of targeting operational technology environments, in both healthcare and industrial sectors. These risks are magnified by legacy platforms, the rise of ransomware, and increasingly sophisticated attackers. Regulatory scrutiny and mandates for rapid patching, segmentation, and real-time detection are on the rise as a result.
6 months ago
Kill Chain
Hitachi Energy TropOS ICS Flaws Threaten Critical Infrastructure Security (2025)
In October 2025, Hitachi Energy disclosed multiple critical vulnerabilities in its TropOS 4th Generation firmware (versions 8.9.6.0 and prior), widely used in critical manufacturing and energy sectors. Three CVEs—CVE-2025-1036, CVE-2025-1037, and CVE-2025-1038—were identified, including OS command injection and improper privilege management flaws in the web-based configuration utility. Exploiting these, authenticated attackers could escalate privileges and obtain root SSH access to affected devices, substantially compromising network security and potentially disrupting critical infrastructure operations. The flaws were reported by Idaho National Laboratory’s CyTRICS program and carry CVSS v4 scores between 7.5 and 8.7. This incident highlights ongoing risks posed by authentication and privilege flaws in industrial control systems (ICS), especially as critical infrastructure devices increasingly attract remote exploitation attempts. It underscores the urgent need for regular firmware updates, network segmentation, and robust access controls amid tightening regulations and persistent adversarial interest in ICS environments.
6 months ago
Kill Chain
CISA Alert: Active Exploits Target Dassault DELMIA Apriso and XWiki in 2025
In October 2025, cybersecurity authorities including CISA confirmed active exploitation of critical vulnerabilities in Dassault Systèmes DELMIA Apriso and XWiki platforms. Threat actors leveraged flaws such as CVE-2025-6204—an 8.0 CVSS code injection bug—to gain unauthorized access and potential code execution on affected systems. The attackers exploited unpatched systems to facilitate lateral movement, data exfiltration, and possible disruption of manufacturing and enterprise workflows. Affected organizations faced immediate operational risk and the prospect of sensitive information compromise. This incident highlights a growing trend in rapid exploitation of recently disclosed enterprise software vulnerabilities. With increased attacker focus on supply chain and collaborative platforms, organizations must respond swiftly to new advisories and prioritize vulnerability management programs to reduce exposure to high-severity threats.
6 months ago
Kill Chain
Oracle EBS Zero-Day Attack Triggers Global Supply Chain Crisis in 2025
In early 2025, multiple organizations experienced cyberattacks stemming from the exploitation of a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS). Threat actors leveraged this flaw to gain unauthorized access, deploy covert tools, and move laterally within victim environments. Notably, high-profile companies such as Schneider Electric may have been impacted, highlighting the sophistication and stealthiness of the attackers, who exploited encrypted and east-west traffic blind spots. The compromise of sensitive business data and disruption of enterprise resource planning systems underscore the far-reaching operational and financial consequences of this campaign. This incident sheds light on the escalating trend of supply chain attacks targeting widely used enterprise software through previously unknown vulnerabilities. The breadth of the campaign and the use of zero-day exploits signal a need for continuous vigilance, rapid patching, and advanced detection controls to defend critical systems against emerging threats.
6 months ago
Kill Chain
Active Exploitation of Dassault DELMIA Apriso Vulnerabilities Impacts Manufacturing Sector
In June 2024, CISA issued an alert highlighting active exploitation of two vulnerabilities (CVE-2024-22120 and CVE-2024-22121) within Dassault Systèmes’ DELMIA Apriso platform, a widely used manufacturing operations management solution. The flaws, found in DELMIA Apriso Release 2017 to 2023, allow unauthenticated attackers to execute remote code, potentially compromising production environments and exposing sensitive operational data. Attackers are leveraging these vulnerabilities to target the manufacturing sector for automated ransomware deployment and data exfiltration, resulting in operational disruption and risk to production integrity. This incident underscores the trend of threat actors focusing on supply chain and OT/IT hybrid platforms, exploiting unpatched flaws for initial access. The urgent CISA advisory signals accelerating regulatory scrutiny and highlights the increased risks posed by software supply chain weaknesses in critical infrastructure sectors.
6 months ago
Kill Chain
North Korea’s Lazarus Group Breaches Drone Developers in 2023 Cyber-Espionage Campaign
In March 2023, the Lazarus Group—an advanced persistent threat attributed to North Korea—successfully targeted three European companies in the defense sector involved in drone development. Leveraging Operation DreamJob, the attackers used social engineering tactics, including fraudulent job offers and a trojanized PDF reader, to gain initial access via phishing emails. The deployment of the ScoringMathTea remote access trojan enabled complete control over compromised systems, potentially allowing sensitive data exfiltration related to unmanned aerial vehicle (UAV) technology and manufacturing know-how. ESET researchers linked the attack to ongoing North Korean efforts to bolster domestic drone capabilities and noted the victims' support of military deployments in Ukraine. The incident exemplifies the persistent and adaptive nature of sophisticated state-linked cyber-espionage campaigns targeting high-value defense technologies. As strategic competition and armed conflicts persist, such tactics have become more prevalent against organizations with intellectual property critical to national security.
6 months ago
Kill Chain
Ransomware Attack on Asahi Disrupts Brewery Operations and Beer Supply in 2024
In early June 2024, the Japanese beverage giant Asahi Group was hit by a ransomware attack that significantly disrupted its domestic brewery operations. Threat actors targeted the company's IT systems, crippling order processing and distribution networks for several days, which led to product shortages and impacted supply chain partners and customers. Asahi confirmed that while immediate containment steps were taken and an investigation was launched, operational downtime and order backlogs persisted as recovery efforts continued, demonstrating the real-world impact of cyberattacks on manufacturing and logistics. This incident highlights the rising trend of ransomware gangs targeting critical sectors like manufacturing, exploiting supply chain dependencies to maximize business disruption and force rapid ransom demands. With attackers increasingly prioritizing operational technology and just-in-time industries, organizations must revisit segmentation, east-west controls, and rapid incident response capabilities to keep pace.
6 months ago
Kill Chain
'PassiveNeuron' SQL Server Attacks Expose Global Sectors to Espionage
In early 2024, a cyber-espionage campaign attributed to the 'PassiveNeuron' threat group targeted organizations in government, industrial, and financial sectors across Asia, Africa, and Latin America. Attackers exploited vulnerable SQL servers as entry points, deploying custom malware to stealthily exfiltrate sensitive data and facilitate lateral movement within compromised environments. The adversaries demonstrated a high degree of operational security, leveraging encrypted channels and bespoke tooling to evade conventional detection, resulting in significant data exposure and operational disruptions for affected entities. This incident reflects the increasing sophistication of cyber-espionage actors leveraging less-monitored databases and novel malware. It highlights a shift toward stealthy, persistent attacks against critical sectors—signaling the need for robust internal monitoring, segmentation, and east-west traffic controls to counter evolving threats.
6 months ago
Kill Chain
Blue Angel Suite Faces 2024 Webctrl.cgi OS Command Injection Attempts
In October 2024, threat actors attempted to exploit an OS command injection vulnerability targeting the Blue Angel Software Suite's web interface on embedded Linux devices. Attackers issued crafted POST requests to the '/cgi-bin/webctrl.cgi' endpoint, aiming to inject arbitrary shell commands via the 'ipaddress' parameter. These attacks, detected by honeypots, mirror previous vulnerabilities such as CVE-2025-34033, which allows authenticated attackers to execute code as root by manipulating input passed to system commands like 'ping'. The incidents highlight persistent risks across IoT and broadband equipment, potentially providing attackers with full system control. This incident underscores a growing trend in targeting network appliances and IoT infrastructure for initial access and lateral movement. As regulatory attention increases and attackers shift toward exploiting device misconfigurations and weak input validation, robust segmentation and up-to-date patch management are even more critical.
6 months ago
Kill Chain
Two CVSS 10.0 Flaws in Red Lion RTUs Expose Industrial Control Environments
In October 2025, two critical vulnerabilities (CVE-2023-40151 and CVE-2023-42770) were publicly disclosed in Red Lion Sixnet RTU devices, which are widely used for industrial automation and critical infrastructure. Both flaws received a CVSS 10.0 rating, underscoring their exploitability and impact. Attackers exploiting these vulnerabilities could achieve remote code execution with the highest privileges, granting them full control over affected devices. These RTUs are often deployed in energy, utilities, and manufacturing, raising concerns about the potential for business disruption, safety risks, and further attacks via compromised operational technology networks. This incident is particularly relevant as it highlights how legacy and specialized industrial control systems remain a prime target for threat actors leveraging zero-day vulnerabilities. The convergence of IT and OT, combined with growing regulatory scrutiny and an uptick in supply chain exposures, means that organizations must refocus on asset visibility and patch management for embedded and hard-to-update devices.
6 months ago
Kill Chain
PassiveNeuron: Unraveling the 2024–2025 Advanced Persistent Attack on Global Servers
Between June 2024 and August 2025, the advanced persistent threat (APT) campaign codenamed "PassiveNeuron" targeted government, financial, and industrial organizations primarily across Asia, Africa, and Latin America. Attackers exploited SQL servers—likely leveraging vulnerabilities or credential brute-forcing—to gain initial access, followed by repeated attempts to deploy web shells. When thwarted by robust endpoint protections, the attackers escalated to advanced techniques, implementing a multi-stage DLL loader chain to deliver custom implants ('Neursite' and 'NeuralExecutor') and leveraging Cobalt Strike for lateral movement and persistence. These tools enabled sophisticated data gathering, process management, and network proxying, all while leveraging various encryption and obfuscation tactics to evade detection. This incident exemplifies the ongoing evolution of targeted cyberespionage against server infrastructure, with attribution leaning towards a Chinese-speaking threat actor based on tactics and C2 infrastructure, though with some ambiguity due to apparent false flags. It reflects a rise in multi-stage, stealthy attacks leveraging both custom and widely abused tools, highlighting the elevated risk posed to internet-exposed critical servers.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports