✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Oil/Energy/Solar/Greentech
Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.
Explore Other Sectors
Oil/Energy/Solar/Greentech Threat Reports
FamousSparrow APT's Persistent Attacks on Azerbaijani Energy Sector in 2026
In late December 2025 through February 2026, the China-linked Advanced Persistent Threat (APT) group known as FamousSparrow targeted an Azerbaijani oil and gas company. The attackers exploited a vulnerable Microsoft Exchange server to gain initial access, deploying sophisticated techniques such as a two-stage DLL sideloading mechanism to evade detection and install remote access tools like Deed RAT and Terndoor. Despite remediation efforts, the group conducted multiple attack waves, indicating a persistent and strategic cyber espionage campaign. ([bitdefender.com](https://www.bitdefender.com/en-us/blog/businessinsights/famoussparrow-apt-targets-azerbaijani-oil-gas-industry?utm_source=openai)) This incident underscores a significant shift in cyber threat landscapes, with Chinese APTs expanding their focus to regions traditionally influenced by other state actors. The use of advanced evasion techniques highlights the evolving sophistication of cyber adversaries, emphasizing the need for robust and proactive cybersecurity measures in critical infrastructure sectors. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/china-famoussparrow-apt-south-caucasus-energy-firm?utm_source=openai))
2 months ago
Kill Chain
FamousSparrow APT's Persistent Attacks on Azerbaijani Energy Infrastructure
Between late December 2025 and late February 2026, a Chinese-affiliated threat actor known as FamousSparrow conducted a multi-wave intrusion targeting an Azerbaijani oil and gas company. The attackers exploited vulnerabilities in Microsoft Exchange servers to gain initial access, deploying sophisticated backdoors such as Deed RAT and Terndoor. Despite multiple remediation efforts, the adversaries persistently re-exploited the same entry points, indicating a high level of determination and technical capability. This campaign underscores the evolving threat landscape where state-sponsored actors are increasingly targeting critical energy infrastructure in geopolitically sensitive regions. The incident highlights the necessity for organizations to implement comprehensive patch management, continuous monitoring, and robust incident response strategies to mitigate such persistent and sophisticated cyber threats.
2 months ago
Kill Chain
Critical Vulnerability in Fuji Electric's Tellus Software: CVE-2026-8108
In May 2026, a critical vulnerability (CVE-2026-8108) was identified in Fuji Electric's Tellus software, version 5.0.2. This flaw allows attackers to escalate privileges from user to system level, potentially leading to denial of service, unauthorized file access, or deletion. The vulnerability arises from the installation process, which adds a driver to the kernel granting all users read and write permissions. Fuji Electric recommends installing Tellus with administrator privileges to mitigate this risk. This incident underscores the persistent challenges in securing industrial control systems, particularly in the critical manufacturing sector. Organizations must remain vigilant, ensuring software installations follow best practices and regularly updating systems to address emerging vulnerabilities.
2 months ago
Kill Chain
ABB Automation Builder Gateway Vulnerability Exposes Industrial Control Systems
In February 2026, ABB disclosed a vulnerability (CVE-2024-41975) in its Automation Builder Gateway for Windows, affecting versions prior to 2.9.0. The gateway, by default, listens on all network adapters on port 1217, allowing unauthenticated remote access. This configuration enables attackers to scan for connected Programmable Logic Controllers (PLCs). While PLC user management typically prevents unauthorized access, if disabled, attackers could potentially interact with the PLCs. ABB addressed this issue in version 2.9.0 by restricting the gateway's default access to local connections. ([cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-25-133-04?utm_source=openai)) This incident underscores the critical importance of secure default configurations in industrial control systems. As cyber threats targeting operational technology environments increase, organizations must ensure that default settings do not expose systems to unnecessary risks. Regularly updating software and reviewing default configurations are essential steps in mitigating such vulnerabilities.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in ABB AC500 V3 PLCs
In February 2026, ABB disclosed multiple vulnerabilities in its AC500 V3 programmable logic controllers (PLCs), specifically affecting firmware versions prior to 3.9.0. The identified vulnerabilities include CVE-2025-2595, which allows unauthenticated remote attackers to bypass user management and access visualization files; CVE-2025-41659, enabling low-privileged remote attackers to read and write certificates and keys via the CODESYS protocol; and CVE-2025-41691, permitting unauthenticated attackers to cause a denial-of-service (DoS) condition through specially crafted communication requests. These vulnerabilities pose significant risks to industrial control systems, potentially leading to unauthorized access, data manipulation, and service disruptions. The relevance of this incident is underscored by the increasing frequency of cyberattacks targeting industrial control systems, highlighting the critical need for robust security measures in operational technology environments. Organizations utilizing ABB's AC500 V3 PLCs are urged to apply the recommended firmware updates promptly to mitigate these vulnerabilities and safeguard their infrastructure against potential exploits.
2 months ago
Kill Chain
Critical Vulnerabilities in ABB WebPro SNMP Card PowerValue Devices: Immediate Action Required
In January 2026, ABB disclosed multiple vulnerabilities in its WebPro SNMP Card PowerValue devices, including CVE-2025-4675, CVE-2025-4676, and CVE-2025-4677. These flaws encompass improper input validation, incorrect authentication algorithm implementation, and insufficient session expiration. Exploitation could allow attackers with adjacent network access to bypass authentication mechanisms, cause denial-of-service conditions, and potentially compromise the confidentiality, integrity, and availability of critical power management systems. ABB has released firmware updates to address these issues and recommends users apply them promptly. The disclosure of these vulnerabilities underscores the ongoing risks associated with industrial control systems and the importance of timely patch management. Organizations relying on ABB's WebPro SNMP Card PowerValue devices should assess their exposure and implement the recommended updates to mitigate potential threats to their operational technology environments.
2 months ago
Kill Chain
Critical Vulnerability in ABB AC500 V3 PLCs: CVE-2025-15467
In March 2026, ABB disclosed a critical vulnerability (CVE-2025-15467) in its AC500 V3 programmable logic controllers (PLCs) running firmware version 3.9.0. The flaw, a stack buffer overflow in the Cryptographic Message Syntax (CMS) parsing module, allows attackers to send specially crafted CMS messages with oversized Initialization Vectors (IVs), leading to potential denial-of-service conditions or remote code execution. This vulnerability affects critical infrastructure sectors globally, including chemical, manufacturing, energy, and water systems. ([library.e.abb.com](https://library.e.abb.com/public/3f2f68976c3c4cc89a5ab895a725244e/3ADR011536%20AC500%20V3%20-%20Stack%20buffer%20overflow%20in%20Cryptographic%20Message%20Syntax.pdf?x-sign=a8r%2F%2FVJ904MPHpN62nDT6cO8nxGbkletTE2yehKQm%2Fyz3hjiFyv3ky484JHLStaP&utm_source=openai)) The incident underscores the persistent risks in industrial control systems (ICS) due to software vulnerabilities. With ICS environments increasingly targeted by cyber threats, timely patching and robust security measures are essential to prevent exploitation and ensure operational continuity.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in Subnet Solutions PowerSYSTEM Center
In May 2026, multiple vulnerabilities were identified in Subnet Solutions Inc.'s PowerSYSTEM Center, a critical infrastructure management platform. These vulnerabilities, including CVE-2026-26289, CVE-2026-33570, CVE-2026-35555, and CVE-2026-35504, could allow authenticated attackers to expose sensitive information, perform unauthorized actions, or inject malicious content. The affected versions span PowerSYSTEM Center 2020, 2024, and 2026 releases. Exploitation of these flaws could lead to unauthorized data access, privilege escalation, and potential disruption of critical manufacturing and energy sectors. The discovery of these vulnerabilities underscores the persistent risks in industrial control systems and the importance of timely software updates. Organizations relying on PowerSYSTEM Center should prioritize applying the recommended patches and reviewing their security protocols to mitigate potential threats.
2 months ago
Kill Chain
UAE Faces Unprecedented Cyberattacks Amid Regional Tensions
In early 2026, the United Arab Emirates (UAE) experienced a significant surge in cyberattacks, with daily breach attempts escalating from 90,000–200,000 to between 600,000 and 800,000 following the onset of military operations by Israel and the U.S. against Iran. These attacks, attributed to nation-state actors and hacktivist groups, targeted critical infrastructure sectors such as finance, telecommunications, aviation, law enforcement, and energy. The UAE's Cybersecurity Council reported that the national cyber defense system successfully thwarted these organized cyberattacks, which included ransomware, phishing campaigns, and the exploitation of artificial intelligence technologies to develop sophisticated offensive tools. ([gulfnews.com](https://gulfnews.com/uae/government/uae-thwarts-terrorist-cyberattacks-targeting-vital-digital-infrastructure-1.500451219?utm_source=openai)) This escalation underscores the evolving nature of cyber threats in the region, highlighting the increasing integration of advanced technologies into malicious digital activities. The UAE's proactive defense measures and improved cyber visibility have been instrumental in mitigating the impact of these attacks, reflecting a broader trend of heightened cyber resilience among Gulf nations. ([thenationalnews.com](https://www.thenationalnews.com/future/technology/2026/02/18/uae-cybersecurity-fake-news-disinformation/?utm_source=openai))
2 months ago
Kill Chain
ABB B&R PVI Vulnerability CVE-2026-0936: Secure Your Systems Now
In January 2026, ABB identified a vulnerability in its B&R PVI client application, specifically versions prior to 6.5.0. The flaw, designated as CVE-2026-0936, involves the insertion of sensitive information into log files. If exploited, an authenticated local attacker could access credential information processed by the PVI client. Notably, the logging function is disabled by default, mitigating immediate risk. ABB has released version 6.5.0 to address this issue and recommends users update promptly. This incident underscores the critical importance of secure logging practices in industrial control systems. As cyber threats targeting operational technology environments increase, organizations must proactively manage vulnerabilities to safeguard sensitive information and maintain system integrity.
2 months ago
Kill Chain
Critical Vulnerability in Hitachi Energy PCM600: CVE-2018-1002208
In April 2026, Hitachi Energy disclosed a vulnerability in its PCM600 product, specifically affecting versions up to 3.1 SP3. The flaw, identified as CVE-2018-1002208, stems from the use of SharpZipLib versions prior to 1.0 RC1, which are susceptible to directory traversal attacks. Exploiting this 'Zip-Slip' vulnerability, attackers can write arbitrary files via crafted Zip archives, potentially compromising system integrity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2018-1002208?utm_source=openai)) This incident underscores the critical importance of timely software updates and vigilant dependency management. Organizations must proactively address known vulnerabilities in third-party libraries to mitigate risks associated with supply chain attacks and ensure the security of their operational environments.
2 months ago
Kill Chain
Critical Vulnerability in ABB B&R Automation Studio: CVE-2025-11043
In January 2026, ABB disclosed a critical vulnerability (CVE-2025-11043) in its B&R Automation Studio software versions prior to 6.5. This flaw involves improper certificate validation in the OPC-UA and ANSL over TLS clients, potentially allowing unauthenticated attackers to intercept and manipulate data exchanges. Such exploitation could lead to unauthorized access and control over industrial automation systems, posing significant risks to operational integrity. The increasing reliance on secure communication protocols in industrial control systems underscores the importance of robust certificate validation mechanisms. This incident highlights the necessity for organizations to promptly update affected systems and implement comprehensive security measures to mitigate similar vulnerabilities.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports