✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Manufacturing
Breach intelligence, attack campaigns, and threat reports targeting the Manufacturing sector.
Explore Other Sectors
Manufacturing Threat Reports
Critical Security Vulnerabilities Discovered in ABB AWIN Gateways
In March 2026, ABB disclosed multiple vulnerabilities in its AWIN Gateways, specifically affecting firmware versions 2.0-0 and 2.0-1 on the GW100 rev.2, and versions 1.2-0 and 1.2-1 on the GW120. These vulnerabilities include authentication bypass by capture-replay (CVE-2025-13777), missing authentication for critical functions leading to remote device reboot (CVE-2025-13778), and unauthorized access to system configurations revealing sensitive details (CVE-2025-13779). Exploitation of these flaws could allow attackers to gain unauthorized access, disrupt device operations, and expose confidential information. ([library.e.abb.com](https://library.e.abb.com/public/3df44661342a482f9b39595fb1457446/4JNO000329_A_en%20Vulnerabilities%20in%20Embedded%20Webserver.pdf?x-sign=hpo%2FlHiVW9S%2FJFfI7on%2BhNiDyo6eVzQkPp6%2BJB4nbIGqiVRH4VpRTPwCRDjUFbLP&utm_source=openai)) The disclosure underscores the critical need for robust security measures in industrial control systems, as such vulnerabilities can have significant operational and safety implications. Organizations utilizing ABB AWIN Gateways should promptly apply the recommended firmware updates and review their network security protocols to mitigate potential risks.
2 months ago
Kill Chain
Critical Vulnerability in Hugging Face's LeRobot Exposes Systems to Remote Code Execution
In April 2026, a critical vulnerability (CVE-2026-25874) was identified in Hugging Face's open-source robotics platform, LeRobot. This flaw, stemming from unsafe deserialization practices using Python's pickle module over unauthenticated gRPC channels, allows unauthenticated attackers to execute arbitrary code on both policy servers and robot clients. Exploitation can lead to full system compromise, data theft, and potential physical safety risks due to the nature of robotic operations. This incident underscores the persistent risks associated with deserializing untrusted data, especially in AI and robotics platforms. It highlights the necessity for secure coding practices, robust authentication mechanisms, and the importance of timely patching to mitigate such vulnerabilities.
2 months ago
Kill Chain
Backdoor.MSIL.XWorm Phishing Campaign Compromises ICS Globally in Q4 2025
In Q4 2025, a significant phishing campaign known as "Curriculum-vitae-catalina" targeted HR personnel globally. Attackers sent emails disguised as job applications, with subjects like "Resume" or "Attached Resume," containing malicious attachments named "Curriculum Vitae-Catalina.exe." When executed, these files installed the Backdoor.MSIL.XWorm malware, granting remote control over infected systems. The campaign unfolded in two waves: the first in October affecting regions including Russia, Western Europe, South America, and Canada; the second in November impacting other areas. The attack subsided by December. Regions with historically high email threat rates, such as Southern Europe, South America, and the Middle East, reported the highest infection rates. In Africa, the malware also spread via USB devices connected to ICS computers. ([securelist.com](https://securelist.com/industrial-threat-report-q4-2025/119392/?utm_source=openai)) This incident underscores the evolving sophistication of phishing attacks targeting industrial control systems (ICS). The widespread distribution and rapid propagation of Backdoor.MSIL.XWorm highlight the critical need for enhanced email security measures and user awareness training to mitigate such threats.
3 months ago
Kill Chain
Black Basta Affiliates Resurface with Targeted Social Engineering Attacks in 2026
In April 2026, a group of former Black Basta affiliates initiated a sophisticated social engineering campaign targeting over 100 employees across multiple organizations. The attackers employed mass email bombing and impersonated IT support via Microsoft Teams to gain unauthorized access to networks, aiming for data theft, ransomware deployment, and extortion. Notably, approximately 75% of the targets were senior executives, directors, and managers, indicating a strategic focus on high-privilege accounts. ([cyberscoop.com](https://cyberscoop.com/black-basta-affiliates-senior-executives-reliaquest/?utm_source=openai)) This resurgence underscores the persistent threat posed by disbanded cybercriminal groups reassembling or reusing effective tactics. The campaign's rapid execution and automation highlight the evolving sophistication of social engineering attacks, emphasizing the need for organizations to bolster their cybersecurity defenses and employee awareness programs. ([cyberscoop.com](https://cyberscoop.com/black-basta-affiliates-senior-executives-reliaquest/?utm_source=openai))
3 months ago
Kill Chain
FBI's 2025 Internet Crime Report: A 26% Surge in Cybercrime Losses
In 2025, the FBI's Internet Crime Complaint Center (IC3) reported a significant surge in cybercrime, with total losses reaching $20.9 billion—a 26% increase from the previous year. The center received over one million complaints, marking a 17% rise compared to 2024. Investment-related fraud led to losses of nearly $8.65 billion, while business email compromise accounted for almost $3.05 billion. Phishing remained the most reported cybercrime, followed by extortion and personal data breaches. ([cyberscoop.com](https://cyberscoop.com/fbi-internet-crime-complaint-center-annual-cybercrime-report/?utm_source=openai)) This escalation underscores the growing sophistication of cybercriminals, who are increasingly leveraging artificial intelligence to enhance their attacks. The trend highlights the urgent need for organizations to bolster their cybersecurity measures and stay vigilant against evolving threats. ([forbes.com](https://www.forbes.com/sites/timkeary/2026/04/07/fbi-reports-208-billion-lost-to-cybercrime-as-hackers-turn-to-ai/?utm_source=openai))
3 months ago
Kill Chain
Schneider Electric's Foxboro DCS Vulnerability Exposes Critical Infrastructure to Cyber Threats
In March 2026, Schneider Electric disclosed a deserialization vulnerability (CVE-2026-1286) in its EcoStruxure Foxboro DCS versions prior to CS8.1. This flaw allows an authenticated administrator to execute arbitrary code by opening a malicious project file, potentially compromising system confidentiality, integrity, and availability. The vulnerability affects critical infrastructure sectors globally, including energy and manufacturing. ([cvedetails.com](https://www.cvedetails.com/cve/CVE-2026-1286/?utm_source=openai)) This incident underscores the persistent risks associated with deserialization vulnerabilities in industrial control systems. Organizations must prioritize timely software updates and implement strict access controls to mitigate such threats effectively.
4 months ago
Kill Chain
Mazda's 2025 Data Breach: A Wake-Up Call for Supply Chain Security
In December 2025, Mazda Motor Corporation identified unauthorized access to a warehouse management system associated with parts procured from Thailand. The breach exposed 692 records containing user IDs, full names, email addresses, company names, and business partner IDs. No customer data was involved. Mazda promptly reported the incident to Japan's Personal Information Protection Commission and implemented enhanced security measures, including reducing internet exposure, applying security patches, increasing monitoring for suspicious activity, and introducing stricter access policies. This incident underscores the persistent threat of cyberattacks targeting supply chain systems. Organizations must remain vigilant, as such breaches can lead to phishing attacks and scams targeting exposed individuals. Implementing robust security protocols and continuous monitoring is essential to mitigate these risks.
4 months ago
Kill Chain
Critical Vulnerability in Inductive Automation's Ignition Software: CVE-2025-13911
In December 2025, a vulnerability (CVE-2025-13911) was identified in Inductive Automation's Ignition SCADA software versions 8.1.x and 8.3.x. This flaw allows authenticated administrators to upload malicious project files containing Python scripts, which execute with SYSTEM-level privileges on Windows systems. The vulnerability arises from insufficient restrictions on Python library imports within the scripting environment, combined with the Ignition service account possessing excessive system permissions. Exploitation could lead to full system compromise, enabling attackers to manipulate automation processes, disrupt operations, exfiltrate sensitive data, or deploy ransomware. ([support.inductiveautomation.com](https://support.inductiveautomation.com/hc/en-us/articles/41992057776397-Script-Resource-Import-Vulnerability-for-Windows-CVE-2025-13911?utm_source=openai)) This incident underscores the critical importance of implementing the principle of least privilege and enforcing strict validation of imported project files in industrial control systems. Organizations must prioritize mitigating such vulnerabilities to safeguard against potential operational disruptions and security breaches.
4 months ago
Kill Chain
Critical Vulnerabilities in Hikvision and Rockwell Automation Devices Added to CISA KEV Catalog
In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2017-7921 affecting Hikvision products and CVE-2021-22681 impacting Rockwell Automation devices. CVE-2017-7921 is an improper authentication flaw that allows attackers to escalate privileges and access sensitive information in Hikvision cameras. CVE-2021-22681 involves insufficiently protected credentials in Rockwell Automation's Studio 5000 Logix Designer and related controllers, enabling unauthorized users to bypass verification mechanisms and alter device configurations. Both vulnerabilities have a CVSS score of 9.8, indicating their severity and the potential risk to critical infrastructure. The inclusion of these vulnerabilities in the KEV catalog underscores the ongoing threat posed by unpatched security flaws in widely used industrial and surveillance equipment. Organizations are urged to prioritize remediation efforts to mitigate the risk of exploitation, especially given the active targeting of such vulnerabilities by malicious actors.
4 months ago
Kill Chain
AkzoNobel's 2026 Encounter with Anubis Ransomware: A Case Study
In early March 2026, AkzoNobel, a leading multinational paint and coatings company, experienced a cyberattack at one of its U.S. sites. The Anubis ransomware group claimed responsibility, asserting they had exfiltrated 170GB of sensitive data, including confidential client agreements, personal employee information, and internal technical documents. AkzoNobel confirmed the breach, stating it was contained to the specific site and that the impact was limited. The company is collaborating with relevant authorities and has initiated notifications to affected parties. This incident underscores the evolving tactics of ransomware groups like Anubis, which have expanded their operations to include data exfiltration and destruction, increasing pressure on victims. Organizations must remain vigilant, as such attacks highlight the critical need for robust cybersecurity measures and incident response plans to mitigate potential damages.
4 months ago
Kill Chain
Siemens 2026 Vulnerability Disclosure: New Multi-CVE Risks in RUGGEDCOM APE1808 Devices
In January 2026, Siemens disclosed multiple security vulnerabilities (including four CVEs: CVE-2025-40891, CVE-2025-40892, CVE-2025-40893, and CVE-2025-40898) affecting its RUGGEDCOM APE1808 devices used in critical manufacturing environments globally. The vulnerabilities include two types of stored cross-site scripting (XSS) and a path traversal flaw, exposing risks such as client-side code execution, privilege escalation, and manipulation of sensitive device configuration. Successful exploitation could enable unauthenticated or authenticated attackers to inject malicious code, alter reports, or compromise system availability, although Siemens’ additional input validation and content security policies restrict some impact scope. The company is working on fix versions and urges customers to apply recommended mitigations and patches promptly. The exposure of critical infrastructure devices to these vulnerabilities highlights the urgent need for robust patch management and network segmentation, especially given the industrial sector’s growing attractiveness to cyberattackers. The incident underscores the rising prevalence of complex, multi-vector attacks targeting operational technology (OT) environments and the increased regulatory pressures demanding enhanced security vigilance and rapid incident reporting.
6 months ago
Kill Chain
Jaguar Land Rover Hit by Devastating 2025 Ransomware Attack: Supply Chains & Data at Risk
In September 2025, Jaguar Land Rover (JLR) suffered a devastating ransomware and extortion attack attributed to the Scattered Lapsus$ Hunters collective, a group comprising threat actors from Lapsus$, Scattered Spider, and ShinyHunters. The attackers breached JLR’s systems, forcing the automaker to halt production and send staff home. The resulting multi-week operational disruption led to a 43% drop in wholesale volumes in the third quarter, significant delays in fulfilling orders, and the confirmed theft of sensitive data. The financial toll exceeded £196 million ($220 million), prompting emergency UK government intervention to support JLR’s supply chain recovery. This incident underscores the evolving risk faced by global manufacturers from sophisticated, identity-centric ransomware actors employing both operational disruption and data theft for extortion. It highlights a broader trend of targeted attacks against critical supply chains, compounding economic impacts and regulatory scrutiny across industries.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports