Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Oil/Energy/Solar/Greentech

Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.

499 threat reports
Page 1 of 42
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Oil/Energy/Solar/Greentech Threat Reports

Showing 1–12 / 499 reports
CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks
CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks
Oil/Energy/Solar/Greentech2 days ago

CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks

In November 2026, CISA published ICS Advisory ICSA-26-307-01 disclosing two critical vulnerabilities (CVE-2026-63017 and CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center, an industrial control system platform widely deployed in critical manufacturing and energy sectors worldwide. CVE-2026-63017, rated CVSS 9.4, allows a low-privileged authenticated user to access administrator-restricted resources via incorrect authorization (CWE-863). CVE-2026-63774, also rated CVSS 9.4, enables authenticated users to execute unauthorized SQL commands through the report designer due to insufficient input validation (CWE-89). Both vulnerabilities require adjacent network access and affect versions spanning the 2020, 2024, and 2026 product lines. Successful exploitation could expose sensitive operational data, manipulate ICS database records, and disrupt energy grid management functions. These vulnerabilities are significant because they target ICS/OT environments in energy and critical manufacturing—sectors already under elevated threat from nation-state and ransomware actors. The combination of privilege escalation and SQL injection within a single OT platform dramatically lowers the bar for insider threats and lateral movement, reflecting a broader trend of attackers targeting operational technology management layers rather than field devices alone.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
APT29's Zero-Click Mobile Campaign: How Russian Hackers Silently Stole Credentials from iOS and Android Devices
APT29's Zero-Click Mobile Campaign: How Russian Hackers Silently Stole Credentials from iOS and Android Devices
Government Administration4 days ago

APT29's Zero-Click Mobile Campaign: How Russian Hackers Silently Stole Credentials from iOS and Android Devices

In late 2026, APT29 (Midnight Blizzard), a Russian state-sponsored threat group, executed a large-scale watering hole campaign targeting iOS and Android users across the U.S., Ukraine, Czech Republic, and Bulgaria. Attackers compromised legitimate high-profile websites and created lookalike domains to deliver JavaScript profiling payloads that fingerprinted visitor devices and browser versions. Based on device type, a tailored n-day exploit chain was silently deployed—requiring zero user interaction—to harvest Safari cookies, WhatsApp and Telegram databases, Keychain credentials, location data, photos, and Chrome login data. The campaign also subverted the Plerdy Ukrainian web analytics tracker, briefly exposing thousands of downstream sites. This campaign underscores a critical shift in nation-state tradecraft: supply chain compromise of analytics scripts combined with zero-click mobile exploitation eliminates traditional phishing dependencies entirely. As mobile devices become primary endpoints for sensitive communications, credential theft via browser-level n-day exploits represents a rapidly escalating threat vector that bypasses conventional endpoint defenses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
VasyGrek Dismantled: What the Russian Infostealer Gang's 100+ Attacks Reveal About Cloud Egress and Segmentation Gaps
VasyGrek Dismantled: What the Russian Infostealer Gang's 100+ Attacks Reveal About Cloud Egress and Segmentation Gaps
Financial Services4 days ago

VasyGrek Dismantled: What the Russian Infostealer Gang's 100+ Attacks Reveal About Cloud Egress and Segmentation Gaps

In November 2026, Russian Ministry of Internal Affairs (MVD) arrested three suspected members of VasyGrek (also known as Fluffy Wolf), a financially motivated threat group active since 2016. The group executed phishing campaigns disguised as financial documents to deploy infostealers and remote access trojans including MetaStealer, WarZone RAT, PureRAT, and BurnsRAT, ultimately siphoning funds from compromised organizational bank accounts. Kaspersky documented over 100 attempted attacks across Russia, Belarus, and Kazakhstan between January and September 2026, targeting metallurgical, healthcare, oil and gas, energy, finance, and government sectors. Authorities seized computer equipment and dismantled virtual server infrastructure spread across foreign jurisdictions. VasyGrek's arrest underscores a persistent and evolving infostealer economy in which off-the-shelf RATs and stealers are layered with multi-stage infection chains and legitimate remote access tools to evade detection. Concurrent activity from Core Werewolf and Insolent Werewolf using ClickFix-style initial access and post-exploitation frameworks signals that the broader threat landscape targeting CIS-region organizations is intensifying, with tactics increasingly blending cybercrime and espionage tradecraft.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes
CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes
Industrial Automation5 days ago

CVE-2026-58115: How Attackers Turned Siemens IoT2050 Devices Into Backdoored Botnet Nodes

In late October 2026, active exploitation of CVE-2026-58115 (CVSS 10.0) was confirmed against Siemens SIMATIC IoT2050 Advanced devices running Node-RED. Unauthenticated remote attackers delivered multi-stage payloads via malicious Node-RED flows, using wget and curl to pull Linux botnet binaries from attacker-controlled servers at 85.215.73[.]250 and 45.194.90[.]57. Implants were disguised as kernel worker threads and stored in memory-backed paths to evade detection. A persistent HTTP backdoor endpoint was also installed, enabling arbitrary command execution even after reboots wiped in-memory implants, compromising operational technology environments at maximum privilege. This incident underscores an accelerating threat to OT and industrial IoT infrastructure, where legacy authentication gaps and internet-exposed management interfaces continue to be weaponized. As critical infrastructure sectors face increasing regulatory scrutiny under frameworks such as NIST CSF 2.0 and IEC 62443, the exploitation of unauthenticated remote code execution vulnerabilities in industrial devices signals a dangerous convergence of IT and OT attack surfaces.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
PapRAT & BITTER: How a South Asian Espionage Group Is Weaponizing Windows Against Critical Infrastructure
PapRAT & BITTER: How a South Asian Espionage Group Is Weaponizing Windows Against Critical Infrastructure
Government Administration6 days ago

PapRAT & BITTER: How a South Asian Espionage Group Is Weaponizing Windows Against Critical Infrastructure

In late 2026, FortiGuard Labs attributed a sophisticated cyber espionage campaign to BITTER (TA397), a South Asian threat group active since 2013, targeting government, energy, and engineering organizations across South Asia. The campaign deployed PapRAT, a custom remote access Trojan recently rewritten from C++ to Rust, via three distinct infection chains leveraging legitimate Windows utilities such as ftp.exe, VHDX disk images, and WebDAV-delivered LNK files. PapRAT enables attackers to execute commands, capture screenshots, manipulate files, and download secondary payloads including WmRAT, providing persistent remote control over compromised Windows systems while evading signature-based endpoint detection. This campaign highlights a growing trend of state-linked espionage actors combining native OS living-off-the-land techniques with custom malware written in memory-safe languages like Rust to frustrate traditional defenses. As geopolitical tensions in South Asia intensify, organizations in critical sectors face heightened risk from persistent, evolving threat actors who continuously retool their capabilities to maintain long-term access.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Hitachi Energy TRO600 Exposed: Unauthenticated File Read and Port-Forwarding Bypass Threaten Energy Grid ICS Devices
Hitachi Energy TRO600 Exposed: Unauthenticated File Read and Port-Forwarding Bypass Threaten Energy Grid ICS Devices
Oil/Energy/Solar/Greentech1 week ago

Hitachi Energy TRO600 Exposed: Unauthenticated File Read and Port-Forwarding Bypass Threaten Energy Grid ICS Devices

In October 2026, CISA republished a Hitachi Energy PSIRT advisory disclosing two high-severity vulnerabilities in the TRO600 series of industrial communication products deployed globally across energy-sector critical infrastructure. CVE-2026-10756 (CVSS 3.1: 7.5) allows an authenticated attacker to abuse port-forwarding to bypass network access restrictions and reach localhost-bound services, enabling unauthorized access to sensitive functionality and confidential data. CVE-2026-106087 (CVSS 4.0: 8.7) is an unauthenticated arbitrary file read flaw that exposes configuration files and credential data without any prior authentication, creating a direct path to credential harvesting and follow-on compromise. Hitachi Energy recommends immediate upgrade to version 9.2.2.1. These vulnerabilities are significant because TRO600 devices sit at the operational technology edge of energy grids and substations worldwide. The combination of an unauthenticated file-read and an authenticated lateral-access bypass mirrors the attack chain patterns observed in recent state-sponsored campaigns targeting energy infrastructure, reinforcing the urgency of ICS/OT network segmentation and encrypted-traffic enforcement.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Hitachi Energy CoreTec Under Fire: Chained OS Command Injection and Kernel Privilege Escalation Threaten Global Energy OT Infrastructure
Hitachi Energy CoreTec Under Fire: Chained OS Command Injection and Kernel Privilege Escalation Threaten Global Energy OT Infrastructure
Oil/Energy/Solar/Greentech1 week ago

Hitachi Energy CoreTec Under Fire: Chained OS Command Injection and Kernel Privilege Escalation Threaten Global Energy OT Infrastructure

In October 2026, CISA published ICS Advisory ICSA-26-302-03 disclosing two high-severity vulnerabilities in Hitachi Energy's CoreTec4 and CoreTec5 industrial cybersecurity appliances, which are widely deployed in global energy infrastructure. CVE-2026-13162 (CVSS 7.5) is an OS command injection flaw in the configuration daemon's timezone handler that allows an authenticated low-privileged user to execute arbitrary system commands with full device control. CVE-2026-43284 (CVSS 8.8) is a Linux kernel IPsec ESP subsystem write-what-where flaw enabling local privilege escalation to root by crafting malicious ESP packets that overwrite privileged OS binaries in memory. Both vulnerabilities affect CoreTec versions 3.4.0 and prior, with remediation requiring upgrade to CoreTec5 version 5.0.0. These disclosures arrive as threat actors, including nation-state groups, intensify targeting of operational technology environments in the energy sector. The combination of an authenticated remote command injection and a kernel-level privilege escalation in a single OT security appliance creates a chained exploitation path that could grant adversaries persistent root access to devices governing critical energy systems, elevating risk across the entire OT kill chain.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Executed Ransomware: Inside the Phantom Framework That Automated Intrusions Across 62 Organizations
AI-Executed Ransomware: Inside the Phantom Framework That Automated Intrusions Across 62 Organizations
Industrial Automation2 weeks ago

AI-Executed Ransomware: Inside the Phantom Framework That Automated Intrusions Across 62 Organizations

In October 2026, cybersecurity researchers at SOCRadar exposed a sophisticated AI-driven intrusion ecosystem operated by affiliates of the INC and The Gentlemen ransomware groups. The operation centered on an autonomous framework called Phantom, which used OpenCode and commercial AI models via OpenRouter to execute human-approved but AI-automated kill chains. Attackers exploited edge devices including FortiClient EMS, SimpleHelp, cPanel, and VPN gateways using multiple CVEs, then moved laterally, harvested credentials, and exfiltrated sensitive data via reverse-SOCKS tunnels before deploying ransomware. Approximately 62 organizations were targeted, with over 50% based in the United States, primarily across industrial, manufacturing, energy, healthcare, and pharmaceutical sectors. This incident signals a structural shift in the ransomware threat landscape: AI agents are now operationalizing intrusion playbooks at machine speed while keeping humans in an approver role. The use of WormGPT-MCP, Ghost C2, and AI-curated victim knowledge bases indicates that agentic AI is rapidly becoming a standard component of ransomware-as-a-service toolkits, compressing attacker timelines and raising the bar for enterprise defenders.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
MythicRatatoskr & Yggdrasil: How Sandworm Used a Mesh Network Backdoor to Wipe Ukrainian Infrastructure
MythicRatatoskr & Yggdrasil: How Sandworm Used a Mesh Network Backdoor to Wipe Ukrainian Infrastructure
Transportation2 weeks ago

MythicRatatoskr & Yggdrasil: How Sandworm Used a Mesh Network Backdoor to Wipe Ukrainian Infrastructure

In July 2025, Russian-aligned threat actor UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company via a spear-phishing email deploying the MATCHWOK backdoor. A day later, the group introduced a previously undocumented implant called MythicRatatoskr, which routed command-and-control traffic through the Yggdrasil peer-to-peer mesh network to evade detection. Over two months later, on September 17, 2025, UAC-0099 handed off access to Sandworm, which executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy—destroying operational data across the compromised environment. This incident marks the first documented abuse of the Yggdrasil mesh network by a state-aligned threat actor for C2 infrastructure, signaling a new evasion frontier. The coordinated handoff between UAC-0099 and Sandworm reflects a maturing division-of-labor model among Russian APT groups, raising the operational risk bar for critical infrastructure defenders globally.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform
When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform
Oil/Energy/Solar/Greentech2 weeks ago

When the Watchdog Has Holes: Seven Vulnerabilities in CISA's Own ICS Monitoring Platform

In October 2026, CISA published ICS Advisory ICSA-26-280-01 disclosing seven vulnerabilities in CISA Malcolm, the agency's own open-source network traffic analysis and ICS security monitoring platform. Reported by Seth Grover of Idaho National Laboratory, the flaws span authentication bypass via nginx regex spoofing (CVE-2026-107336), hardcoded credentials enabling direct Arkime backend access (CVE-2026-107361), SSRF through an unmodified FilePond PHP component (CVE-2026-107362), RBAC bypass via URL path normalization inconsistency (CVE-2026-107333), cross-site request forgery enabling forensic log destruction (CVE-2026-107337), percent-encoding authorization bypass (CVE-2026-107334), and a gzip-bomb denial-of-service (CVE-2026-107335). Collectively these vulnerabilities expose critical-infrastructure operators—in Energy, IT, and Water sectors worldwide—to unauthenticated access, privilege escalation, lateral movement, and destruction of forensic evidence. The compromise of a security-monitoring tool itself represents an acute supply-chain and defense-evasion risk. As ICS/OT environments deepen their dependence on network-visibility platforms, adversaries now actively target the monitoring layer—blinding defenders while moving laterally through operational technology networks, a tactic increasingly observed in critical-infrastructure threat campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Hard-Coded Credentials in EseeCloud IP Cameras Give Attackers Full Remote Control—No Patch Available
Hard-Coded Credentials in EseeCloud IP Cameras Give Attackers Full Remote Control—No Patch Available
Government Administration2 weeks ago

Hard-Coded Credentials in EseeCloud IP Cameras Give Attackers Full Remote Control—No Patch Available

In October 2026, CISA published ICS Advisory ICSA-26-288-02 disclosing three critical-to-medium severity vulnerabilities in Guangzhou Juan IoT Technology's EseeCloud IP camera platform, affecting App versions ≤4.9.6 and Firmware versions ≤4.9.86.0 deployed worldwide across energy, communications, transportation, financial services, and government sectors. The most severe flaw, CVE-2026-107617 (CVSS 9.8), embeds hard-coded credentials that allow any remote, unauthenticated attacker to log in to EseeCloud devices at will. A second vulnerability, CVE-2026-97858, permits unauthorized device rebinding—stripping ownership from legitimate users and reassigning control to an attacker. A third flaw, CVE-2026-105664, exposes an enumeration oracle that lets token-holders discover every registered device serial ID at scale due to absent rate limiting. The vendor did not respond to CISA's coordination attempts, leaving no vendor patch available. These findings arrive amid a documented surge in nation-state and criminal exploitation of consumer and industrial IoT devices as persistent footholds into critical infrastructure networks. Hard-coded credential abuse in embedded devices has become a primary initial-access vector, and the absence of encrypted traffic controls means camera feeds and command channels remain fully interceptable once an attacker gains network adjacency.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Six OPC UA Flaws in Eclipse Milo Put Critical Infrastructure at Risk: What Security Teams Must Do Now
Six OPC UA Flaws in Eclipse Milo Put Critical Infrastructure at Risk: What Security Teams Must Do Now
Oil/Energy/Solar/Greentech2 weeks ago

Six OPC UA Flaws in Eclipse Milo Put Critical Infrastructure at Risk: What Security Teams Must Do Now

In October 2026, CISA published ICS Advisory ICSA-26-288-01 disclosing six critical-to-high severity vulnerabilities in Eclipse Foundation Eclipse Milo, the widely deployed open-source OPC UA SDK used across chemical, energy, critical manufacturing, and water sectors worldwide. Flaws span incorrect authorization (CVE-2026-62927), missing authorization on diagnostics nodes (CVE-2026-63248, CVE-2026-58080), a padding-oracle attack enabling credential recovery (CVE-2026-60007), and two resource-exhaustion denial-of-service bugs (CVE-2026-63252, CVE-2026-61387). Unauthenticated remote attackers can delete protected OT data, impersonate legitimate users, or crash OPC UA servers entirely. The Eclipse Foundation has released version 1.1.5 as the remediation. These vulnerabilities underscore a systemic risk in ICS/OT environments: open-source protocol libraries embedded deep in industrial control stacks often escape rigorous security review cycles. As OPC UA adoption accelerates for Industry 4.0 connectivity, authorization bypasses and cryptographic weaknesses in foundational SDKs present nation-state and ransomware actors with high-value, low-friction entry points into operational technology networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports