✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Manufacturing
Breach intelligence, attack campaigns, and threat reports targeting the Manufacturing sector.
Explore Other Sectors
Manufacturing Threat Reports
Microsoft Teams Vishing Attacks Facilitate Chaos Ransomware Deployment in 2026
Between February and June 2026, threat actors conducted a campaign targeting North American organizations by impersonating IT support staff via Microsoft Teams. They initiated chats and voice calls to deceive employees into granting remote access through tools like Microsoft Quick Assist and RemSupp. Once access was obtained, attackers deployed backdoors, established persistence, and in at least three instances, executed Chaos ransomware, encrypting files across compromised devices. One attack progressed from initial access to full encryption in under 17 hours. This incident underscores the evolving sophistication of social engineering tactics, particularly the exploitation of trusted communication platforms like Microsoft Teams. The rapid progression from initial access to ransomware deployment highlights the critical need for organizations to enhance their security awareness training and implement robust access controls to mitigate such threats.
1 week ago
Kill Chain
Bearlyfy's Custom GenieLocker Ransomware: A New Threat to Russian Enterprises
In March 2026, the pro-Ukrainian hacking group Bearlyfy, also known as Labubu, launched over 70 cyberattacks against Russian companies, primarily targeting the manufacturing sector. The group deployed a custom-built Windows ransomware strain named GenieLocker, marking a significant evolution from their previous use of third-party encryptors like LockBit 3 and Babuk. These attacks involved exploiting external services and vulnerable applications to gain access, followed by the deployment of tools such as MeshAgent for remote access and encryption. Ransom demands escalated to hundreds of thousands of dollars, with approximately 20% of victims reportedly paying. ([thehackernews.com](https://thehackernews.com/2026/03/bearlyfy-hits-70-russian-firms-with.html?utm_source=openai)) This incident underscores the increasing sophistication and boldness of hacktivist groups in leveraging custom malware to achieve both financial gain and strategic sabotage. The development and deployment of proprietary ransomware like GenieLocker highlight a trend where threat actors are investing in bespoke tools to enhance their operational effectiveness and evade detection. ([thehackernews.com](https://thehackernews.com/2026/03/bearlyfy-hits-70-russian-firms-with.html?utm_source=openai))
1 week ago
Kill Chain
Dysphoria IoT Botnet: A New Era of Resilient Cyber Threats
In July 2026, cybersecurity researchers identified a new IoT botnet named Dysphoria, which has infected approximately 200,000 devices globally. Following the March 2026 law enforcement takedown of the JackSkid botnet, Dysphoria emerged with enhanced resilience by integrating blockchain-based command-and-control (C2) mechanisms and utilizing infected devices as relays to obscure its infrastructure. This evolution complicates traditional disruption methods and poses significant challenges to cybersecurity defenses. The adoption of blockchain name services for C2 resolution and the use of victim devices as relays represent a concerning trend in botnet development. These tactics not only enhance the botnet's resilience against takedown efforts but also indicate a shift towards more sophisticated and decentralized control structures in cyber threats.
1 week ago
Kill Chain
Clop Ransomware Exploits Critical Vulnerability in PTC Windchill and FlexPLM
In July 2026, the Clop ransomware group exploited a critical vulnerability (CVE-2026-12569) in PTC's Windchill and FlexPLM systems, leading to unauthorized remote code execution. This flaw allowed attackers to deploy JSP webshells, facilitating the exfiltration of sensitive product data from compromised organizations. The exploitation of this vulnerability underscores the persistent threat posed by ransomware groups targeting critical infrastructure and intellectual property. Organizations utilizing PTC's Windchill and FlexPLM platforms are urged to apply the latest security patches and implement robust monitoring to detect and prevent such intrusions.
2 weeks ago
Kill Chain
Stadler Rail Rejects $12.3M Ransom After Cyberattack
In mid-July 2026, Swiss rail manufacturer Stadler Rail experienced a cyberattack when the Everest ransomware group accessed a data exchange platform shared with one of its suppliers. The attackers demanded a ransom of 10 million Swiss francs (approximately $12.3 million) after obtaining technical information. Stadler's internal IT systems and production operations remained unaffected, and the company refused to pay the ransom, filing a criminal complaint with the Thurgau cantonal police. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/swiss-rail-giant-stadler-rejects-123m-ransom-demand-after-cyberattack/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where cybercriminals exploit vulnerabilities in third-party vendors to infiltrate larger organizations. The Everest group's focus on data theft and extortion, rather than traditional ransomware encryption, highlights the evolving tactics of threat actors in the cybersecurity landscape.
2 weeks ago
Kill Chain
Ransomware Surge in 2026: Understanding the 25% Increase and Its Implications
Between April 2025 and March 2026, ransomware incidents surged by 25%, with 7,551 known victims worldwide. This escalation was driven by the emergence of over 60 new ransomware groups and a significant increase in attacks targeting small and medium-sized businesses (SMBs). Notably, the Qilin ransomware group experienced a 443% year-over-year increase in activity, operating across more than 50 countries. The manufacturing sector remained the top target, accounting for 1,660 victims. ([gbhackers.com](https://gbhackers.com/2026-ransomware-report/?utm_source=openai)) This trend underscores the evolving threat landscape, where ransomware groups are becoming more operationalized, and the barriers to entry are lowering. Organizations must enhance their cybersecurity measures, focusing on patching known vulnerabilities, strengthening vendor oversight, and preparing for AI-driven threats. ([mbtmag.com](https://www.mbtmag.com/cybersecurity/news/22970998/report-addresses-evolving-state-of-ransomware?utm_source=openai))
2 weeks ago
Kill Chain
Anubis Ransomware Attack Disrupts Coca-Cola's Fairlife U.S. Operations
In July 2026, Coca-Cola's subsidiary, Fairlife, experienced a ransomware attack attributed to the Anubis group. The attackers gained unauthorized access to production-related systems, leading to a temporary suspension of U.S. operations. While product quality and safety remained unaffected, the incident disrupted supply chains and highlighted vulnerabilities in critical infrastructure. ([techradar.com](https://www.techradar.com/pro/security/coca-cola-shuts-down-fairlife-dairy-production-lines-following-ransomware-attack?utm_source=openai)) This attack underscores a growing trend of ransomware groups targeting essential industries, emphasizing the need for robust cybersecurity measures and incident response plans to mitigate operational disruptions and protect sensitive data.
2 weeks ago
Kill Chain
Critical Vulnerability in Siemens Mendix Studio Pro: CVE-2026-48192
In June 2026, Siemens disclosed a vulnerability (CVE-2026-48192) in Mendix Studio Pro versions 10.11 through 10.24 (prior to V10.24.21) and 11.0 through 11.11. The flaw arises from improper validation and sanitization of project files during the build pipeline, allowing attackers to execute arbitrary code if a user opens a specially crafted malicious project. This vulnerability could lead to unauthorized code execution within the user's context, potentially compromising developer workstations and downstream build artifacts. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-48192/?utm_source=openai)) The incident underscores the critical importance of validating and sanitizing project files in development environments. As low-code platforms like Mendix Studio Pro gain popularity, ensuring robust security measures against such vulnerabilities becomes imperative to protect development processes and prevent potential supply chain attacks.
1 month ago
Kill Chain
Critical Vulnerability in Schneider Electric's License Manager Poses Risks to Industrial Systems
In 2024, a critical vulnerability identified as CVE-2024-2658 was discovered in Schneider Electric's Floating License Manager, specifically within the FlexNet Publisher component. This flaw, classified under CWE-427: Uncontrolled Search Path Element, allows local non-administrative users to manipulate the OpenSSL configuration file, leading to the execution of arbitrary code with elevated privileges. Exploitation of this vulnerability can result in full control over the affected system, including access to sensitive data and potential lateral movement within industrial networks. The urgency to address this vulnerability is heightened by the increasing targeting of industrial control systems by cyber adversaries. Organizations utilizing Schneider Electric's software are advised to implement the recommended mitigations promptly to prevent potential exploitation and safeguard critical infrastructure.
1 month ago
Kill Chain
Critical XZ Utils Vulnerability Affects B&R Products (CVE-2025-31115)
In June 2026, B&R Industrial Automation GmbH disclosed a critical vulnerability (CVE-2025-31115) in their products due to a flaw in XZ Utils versions 5.3.3alpha to 5.8.0. This race condition within the multithreaded .xz decoder in liblzma could allow attackers to crash the system or corrupt memory data. Affected products include PPC3100, C50, C80, FT50, MT50, T30, T80, and T50, with specific versions listed in the advisory. The vulnerability has a CVSS v3 base score of 7.5, indicating high severity. ([cisa.gov](https://www.cisa.gov/sites/default/files/publications/web-metrics/CISA.gov-Apr-2024-Web-Metrics-508.pdf?utm_source=openai)) This incident underscores the importance of promptly addressing vulnerabilities in widely used open-source libraries. Organizations are advised to update to XZ Utils version 5.8.1 or apply the provided patches to mitigate potential risks. ([cisa.gov](https://www.cisa.gov/sites/default/files/publications/web-metrics/CISA.gov-Apr-2024-Web-Metrics-508.pdf?utm_source=openai))
1 month ago
Kill Chain
CISA Adds Two Known Exploited Vulnerabilities to Catalog
On June 25, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-12569, an improper input validation vulnerability in PTC Windchill and FlexPLM, and CVE-2026-20230, a server-side request forgery (SSRF) vulnerability in Cisco Unified Communications Manager. These vulnerabilities are actively exploited by malicious actors, posing significant risks to federal enterprises. CISA's Binding Operational Directive (BOD) 26-04 mandates federal agencies to prioritize remediation of such high-risk vulnerabilities to protect their networks against active threats. While BOD 26-04 applies to Federal Civilian Executive Branch (FCEB) agencies, CISA encourages all organizations to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to update the catalog as new vulnerabilities are identified.
1 month ago
Kill Chain
Critical Vulnerability in Lantronix EDS5000 Devices Actively Exploited
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about active exploitation of a critical vulnerability in Lantronix EDS5000 Series devices. Identified as CVE-2025-67038 with a CVSS score of 9.8, this code injection flaw allows unauthenticated attackers to execute arbitrary OS commands with root privileges by exploiting improper input sanitization in the HTTP RPC module. The vulnerability was disclosed in April 2026 as part of the BRIDGE:BREAK set of vulnerabilities affecting serial-to-IP converters from Lantronix and Silex. The active exploitation of CVE-2025-67038 underscores the increasing targeting of IoT devices in critical infrastructure. Organizations must prioritize patching vulnerable systems and implementing robust input validation to mitigate such risks.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports