Industry Category

Industrial Automation

Breach intelligence, attack campaigns, and threat reports targeting the Industrial Automation sector.

298 threat reports
Page 3 of 25
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Industrial Automation Threat Reports

Showing 25–36 / 298 reports
Advantest Ransomware Attack Exposes Critical Gaps in Semiconductor Supply Chain Security
Advantest Ransomware Attack Exposes Critical Gaps in Semiconductor Supply Chain Security
Semiconductors1 month ago

Advantest Ransomware Attack Exposes Critical Gaps in Semiconductor Supply Chain Security

In February 2026, Advantest Corporation, a leading Japanese semiconductor test equipment manufacturer, suffered a ransomware attack that compromised sensitive personal information of individuals. Threat actors gained unauthorized access to company systems, deployed ransomware, and exfiltrated data containing contact information, Social Security numbers, driver's licenses, passport numbers, medical information, and financial data. The company took eight months to confirm the data breach, notifying affected individuals in October 2026 and offering 18-month identity monitoring services through Kroll. This incident highlights the continuing evolution of ransomware groups targeting critical semiconductor supply chain companies, exploiting the industry's increasing digitization and interconnected manufacturing processes that are vital to global technology infrastructure.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical lwIP SMTP Vulnerability Threatens Global Industrial Infrastructure
Critical lwIP SMTP Vulnerability Threatens Global Industrial Infrastructure
Utilities1 month ago

Critical lwIP SMTP Vulnerability Threatens Global Industrial Infrastructure

A critical buffer overflow vulnerability (CVE-2026-15340) was discovered in the Savannah lwIP SMTP client version 2.2.1, affecting industrial control systems and critical infrastructure worldwide. The vulnerability, scored 9.8 on the CVSS scale, allows remote attackers to execute arbitrary code without authentication by exploiting the client's failure to validate input sizes during buffer operations. The flaw impacts energy and water treatment facilities globally, as the lwIP stack is widely deployed in embedded systems and IoT devices. A patch has been released and organizations are urged to update immediately to prevent potential system crashes and remote code execution. This incident highlights the growing threat to operational technology environments as attackers increasingly target embedded systems and industrial protocols. With critical infrastructure under constant threat from nation-state actors and the expanding attack surface of connected industrial devices, vulnerabilities in fundamental networking components like lwIP pose significant risks to essential services.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Vulnerabilities in Hitachi Energy RTU500 Systems Threaten Industrial Infrastructure
Critical Vulnerabilities in Hitachi Energy RTU500 Systems Threaten Industrial Infrastructure

Critical Vulnerabilities in Hitachi Energy RTU500 Systems Threaten Industrial Infrastructure

Hitachi Energy disclosed critical vulnerabilities in end-of-life RTU500 industrial control systems, discovered by Dragos researchers and published in CISA advisory ICSA-26-279-06. The vulnerabilities affect RTU500 CMU firmware versions 11.x and prior, including authentication bypass (CVE-2026-8065), directory traversal (CVE-2026-8066), and improper authorization issues that allow remote attackers to upload malicious firmware, overwrite system files, and execute arbitrary commands. These legacy systems lack modern security controls and encrypted communications, creating significant risks for critical infrastructure operators worldwide who have not upgraded to supported firmware versions 12.7.8 or 13.9.1. This incident highlights the growing threat to aging industrial control systems as attackers increasingly target critical infrastructure through legacy vulnerabilities and insufficient operational technology security measures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Supply Chain Vulnerability Exposes Energy Infrastructure to Remote Code Execution
Critical Supply Chain Vulnerability Exposes Energy Infrastructure to Remote Code Execution
Utilities1 month ago

Critical Supply Chain Vulnerability Exposes Energy Infrastructure to Remote Code Execution

Hitachi Energy disclosed a critical Remote Code Execution vulnerability (CVE-2026-34197) in Apache ActiveMQ components within their SOI (System Operation Interface) product versions 2.0.0 to 2.2.0. The vulnerability stems from improper input validation in Apache ActiveMQ's Jolokia JMX-HTTP bridge, allowing authenticated attackers to execute arbitrary code through crafted discovery URIs that trigger Spring XML application context loading. With a CVSS score of 8.8, this supply chain vulnerability affects critical energy infrastructure worldwide and can compromise confidentiality, integrity, and availability of industrial control systems. Hitachi Energy has released EP2 patch to upgrade ActiveMQ to version 5.19.5 and implement additional security measures. This incident highlights the growing threat landscape targeting industrial control systems and critical infrastructure through supply chain vulnerabilities. As nation-state actors increasingly focus on energy sector disruption and industrial espionage, organizations must prioritize patching and securing third-party components in operational technology environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerabilities Discovered in Hitachi Energy REB500 Industrial Control Systems
Critical Vulnerabilities Discovered in Hitachi Energy REB500 Industrial Control Systems

Critical Vulnerabilities Discovered in Hitachi Energy REB500 Industrial Control Systems

Hitachi Energy disclosed critical vulnerabilities in their REB500 industrial control system affecting versions 8.3.3.1 and prior. Two CVEs (CVE-2024-8176 and CVE-2025-59375) target the libexpat library used by IEC 61850 functionality, allowing authenticated attackers with local access to execute denial of service attacks through crafted messages. CVE-2024-8176 involves stack overflow through uncontrolled recursion, while CVE-2025-59375 enables resource exhaustion via unbounded memory allocation. Both vulnerabilities carry CVSS scores of 6.5 and can disrupt critical energy infrastructure operations. Hitachi Energy has released version 8.3.4.0 to address these issues. These vulnerabilities highlight the growing threat landscape facing industrial control systems as critical infrastructure becomes increasingly digitized. With energy sector attacks rising and nation-state actors targeting industrial systems, organizations must prioritize OT security updates and implement proper network segmentation to protect against similar library-based exploits.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Hitachi Energy Asset Suite Vulnerabilities Expose Global Energy Infrastructure to Cyberattacks
Critical Hitachi Energy Asset Suite Vulnerabilities Expose Global Energy Infrastructure to Cyberattacks
Utilities1 month ago

Critical Hitachi Energy Asset Suite Vulnerabilities Expose Global Energy Infrastructure to Cyberattacks

Hitachi Energy Asset Suite versions 9.9.0 and prior contain critical unauthenticated servlet access vulnerabilities (CVE-2026-7395 and CVE-2026-11796) that allow attackers to compromise confidentiality, integrity, and availability of energy sector systems. CVE-2026-7395 enables unauthorized configuration file uploads through HTTPPublishAdapterTestServlet, while CVE-2026-11796 allows unauthenticated access to multiple servlets that can trigger denial-of-service conditions. These vulnerabilities affect critical infrastructure worldwide, with systems deployed across global energy networks. This incident highlights the growing security risks in industrial control systems as energy infrastructure becomes increasingly digitized and interconnected, particularly following recent high-profile attacks on critical infrastructure by nation-state actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Infrastructure Engineer Sentenced for $750K Ransomware-Style Insider Attack
Infrastructure Engineer Sentenced for $750K Ransomware-Style Insider Attack

Infrastructure Engineer Sentenced for $750K Ransomware-Style Insider Attack

In November 2023, Daniel Rhyne, a 57-year-old core infrastructure engineer at a New Jersey industrial company, executed a ransomware-style insider attack that locked over 3,000 devices across his employer's network. Using administrator credentials, Rhyne systematically changed passwords for 301 domain user accounts and multiple admin accounts to 'TheFr0zenCrew!', deleted 13 domain admin accounts, and shut down random servers. He demanded 20 Bitcoin (approximately $750,000) in a ransom email titled 'Your Network Has Been Penetrated', threatening to shut down 40 servers daily for ten days unless paid. Rhyne was sentenced to 32 months in federal prison in 2024. This case highlights the growing threat of insider attacks as organizations face increasing pressure from disgruntled employees and the evolving sophistication of internal threat actors who leverage legitimate access for malicious purposes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical ABB PCM600 Vulnerabilities Expose Energy Infrastructure to Privilege Escalation Attacks
Critical ABB PCM600 Vulnerabilities Expose Energy Infrastructure to Privilege Escalation Attacks
Utilities1 month ago

Critical ABB PCM600 Vulnerabilities Expose Energy Infrastructure to Privilege Escalation Attacks

ABB's Protection and Control IED Manager PCM600 version 2.14 and earlier contains two critical vulnerabilities (CVE-2026-15952 and CVE-2026-15953) that enable privilege escalation and path traversal attacks. CVE-2026-15952 allows attackers with local access to exploit the Scheduler Service running under LocalSystem to gain elevated privileges, while CVE-2026-15953 permits malicious project archive files to write content outside intended directories through insufficient path validation. These vulnerabilities impact energy sector critical infrastructure worldwide, potentially allowing attackers to gain system control or deploy malicious files in sensitive industrial control environments. These vulnerabilities highlight the growing threat to operational technology (OT) environments as attackers increasingly target industrial control systems. With energy infrastructure becoming a prime target for nation-state actors and ransomware groups, securing ICS/SCADA systems against privilege escalation and file manipulation attacks has become critical for maintaining grid stability and preventing operational disruptions.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Zero-Day in TDengine Database Threatens 730K+ Industrial Systems
Critical Zero-Day in TDengine Database Threatens 730K+ Industrial Systems

Critical Zero-Day in TDengine Database Threatens 730K+ Industrial Systems

A high-severity zero-day vulnerability (CVE-2026-42542) was discovered in TDengine, an open-source time-series database used across industrial, IoT, energy, and automotive sectors. The flaw allows unauthenticated attackers to crash vulnerable servers with a single malformed network packet, affecting over 730,000 instances globally including systems at Siemens, McDonald's, and Sinopec. The vulnerability stems from an integer-underflow bug in pre-authentication message parsing, making exploitation trivial for attackers with network access to the default port 6030. Ridge Security researchers developed a proof-of-concept exploit but chose not to publicly release it, while TDengine has released a patched version (3.4.1.6). This incident highlights the growing threat landscape targeting operational technology environments, where traditional IT security tools often provide inadequate coverage. As industrial systems become increasingly connected and dependent on data analytics platforms, vulnerabilities in critical infrastructure components pose escalating risks to operational continuity and safety.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Path Traversal Flaw Exposes Siemens Industrial Systems to Remote File Access
Critical Path Traversal Flaw Exposes Siemens Industrial Systems to Remote File Access

Critical Path Traversal Flaw Exposes Siemens Industrial Systems to Remote File Access

Siemens SIMOVE Fleetmanager and SIPLANT industrial management systems contain a critical path traversal vulnerability (CVE-2026-67367) with a CVSS score of 8.6. The flaw allows unauthenticated remote attackers to read arbitrary files from the underlying operating system through improper validation of directory traversal sequences in the embedded HTTP server's file-serving endpoint. Affected systems span multiple product versions deployed worldwide in critical manufacturing sectors, potentially exposing sensitive data including credential stores, private keys, and configuration secrets. This vulnerability highlights the persistent security challenges in industrial control systems and operational technology environments. As organizations increasingly digitize their manufacturing operations and connect OT systems to corporate networks, path traversal vulnerabilities in critical infrastructure components represent a growing attack surface that demands immediate attention and systematic security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Critical Copy Fail Vulnerability Exposes Siemens Industrial Control Systems
Critical Copy Fail Vulnerability Exposes Siemens Industrial Control Systems

Critical Copy Fail Vulnerability Exposes Siemens Industrial Control Systems

In September 2026, CISA disclosed CVE-2026-31431, known as the "Copy Fail" vulnerability, affecting multiple Siemens SIPLUS and SIMATIC industrial control products. The vulnerability stems from incorrect resource transfer between spheres in the Linux kernel's crypto subsystem, specifically in the algif_aead component. With a CVSS score of 7.8, the flaw allows local attackers with low privileges to potentially achieve high confidentiality, integrity, and availability impacts on affected systems. Siemens has released patches for most affected products, updating them to version 21.2.1 or later, while recommending specific countermeasures for products where fixes are not yet available. This incident highlights the growing sophistication of attacks targeting industrial control systems and the critical importance of maintaining updated security patches in operational technology environments. As industrial networks become increasingly connected and digitized, vulnerabilities like Copy Fail demonstrate the urgent need for comprehensive security frameworks that can protect critical infrastructure from both known and emerging threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Siemens Industrial Control Vulnerability Exposes Critical Infrastructure to Denial of Service Attacks
Siemens Industrial Control Vulnerability Exposes Critical Infrastructure to Denial of Service Attacks

Siemens Industrial Control Vulnerability Exposes Critical Infrastructure to Denial of Service Attacks

Siemens has disclosed a critical vulnerability (CVE-2026-89207) affecting WTV676 and WTV776 industrial control devices used in energy infrastructure worldwide. The vulnerability allows unauthenticated remote attackers to exploit improper input validation from backend services, forcing devices into protection mode and disabling remote connectivity functions. This denial of service attack vector poses significant operational risks to critical infrastructure, particularly in energy sectors where these devices are deployed globally. The CVSS 6.5 rated vulnerability affects WTV676-HB6035 Web Interface versions below 3.94 and WTV776-HB6035 Web Interface versions below 4.17. This incident highlights the ongoing challenge of securing industrial control systems as cyber threats increasingly target critical infrastructure. With growing concerns about nation-state actors and ransomware groups focusing on operational technology environments, vulnerabilities in widely-deployed industrial devices represent escalating risks to essential services and national security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Looking for threats in a different sector?

Browse All Threat Reports