✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Oil/Energy/Solar/Greentech
Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.
Explore Other Sectors
Oil/Energy/Solar/Greentech Threat Reports
Rockwell Automation's ArmorStart LT Vulnerabilities: A Wake-Up Call for Industrial Security
In January 2026, Rockwell Automation disclosed multiple vulnerabilities in its ArmorStart® LT motor control devices, specifically models 290D, 291D, and 294D up to and including version V2.002. These vulnerabilities, identified as CVE-2025-9464 through CVE-2025-9283, can lead to denial-of-service conditions. Exploitation methods include fuzzing of CIP classes, execution of Achilles Comprehensive grammar tests, and active scanning with tools like Burp Suite, causing devices to become unresponsive or reboot unexpectedly. ([rockwellautomation.com](https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html?utm_source=openai)) The affected devices are widely used in the critical manufacturing sector globally. As of the disclosure, no patches or upgrades were available. Rockwell Automation recommends applying security best practices to mitigate risks, such as minimizing network exposure, placing devices behind firewalls, and using secure remote access methods like VPNs. ([rockwellautomation.com](https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html?utm_source=openai))
5 months ago
Kill Chain
Sandworm's DynoWiper Targets Poland's Energy Sector in 2025 Cyberattack
In late December 2025, Poland's energy infrastructure was targeted by a cyberattack involving a data-wiping malware named DynoWiper. The attack aimed to disrupt operations at two combined heat and power plants and several renewable energy facilities. ESET researchers attributed the attack to the Russian state-sponsored group Sandworm, noting similarities to previous incidents involving the group. Fortunately, the malware was intercepted before causing any substantial damage, and no operational disruptions were reported. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors to critical infrastructure. The timing, coinciding with the tenth anniversary of Sandworm's first known assault on Ukraine’s power grid in 2015, highlights the group's continued focus on energy sector targets and disruptive operations. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/?utm_source=openai))
5 months ago
Kill Chain
Critical Privilege Escalation Vulnerability Discovered in Iconics Suite
In early 2024, a security assessment revealed a vulnerability in the Iconics Suite, a SCADA system used across various industries. Tracked as CVE-2025-0921, this flaw allows local authenticated attackers to exploit privileged file system operations, potentially leading to a denial-of-service (DoS) condition by corrupting critical system binaries. The vulnerability affects all versions of GENESIS64, MC Works64, and GENESIS version 11.00. Mitsubishi Electric has released advisories detailing measures to address the issue. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/iconics-suite-cve-2025-0921/?utm_source=openai)) This incident underscores the critical importance of securing SCADA systems, especially given their role in industrial operations. The discovery of CVE-2025-0921 highlights the need for continuous security assessments and prompt application of vendor-released patches to mitigate potential threats.
5 months ago
Kill Chain
2024 Critical Telnet Flaw: How Legacy Protocols Created a Global Attack Surface
In early 2024, security researchers uncovered a critical vulnerability affecting widely used Telnet server software running on hundreds of thousands of legacy and IoT devices worldwide. Attackers exploited the bug, which allowed unauthenticated remote access using unencrypted Telnet sessions, to compromise network and industrial systems, bypass access controls, and rapidly pivot laterally. Many affected devices remained unpatched due to lack of vendor support, making remediation difficult and exposing organizations in healthcare, manufacturing, and critical infrastructure to potential downtime and data theft. This incident highlights the enduring risk of forgotten, legacy protocols like Telnet persisting in enterprise environments. Attackers increasingly scan for and exploit such overlooked attack surfaces, emphasizing the need for proactive inventory, segmentation, and the retirement of obsolete network services to defend against emergent threats.
5 months ago
Kill Chain
Electrum-Linked Wiper Attack Disables Key Systems in Polish Energy Grid
In late December 2025, a coordinated cyberattack targeted Poland’s distributed energy resource (DER) sites, including combined heat and power, wind, and solar dispatch facilities. The attackers, identified as the Russian-linked Electrum (overlapping with APT44/Sandworm), exploited misconfigurations and exposed operational technology, corrupting or destroying key OT and Windows systems at nearly 30 sites. While no electrical outages were reported and power generation largely continued, remote monitoring and control capabilities were disabled and some equipment rendered inoperable, exposing critical vulnerabilities in Poland’s decentralized energy grid. This incident highlights a significant evolution in threat actor tactics toward industrial systems, specifically targeting the backbone of modern hybrid energy infrastructure. Increased focus on OT security, zero-trust segmentation, and resilient operational controls is crucial as sophisticated groups continue probing for weaknesses in vital infrastructure globally.
6 months ago
Kill Chain
Russian ELECTRUM APT Strikes Polish Power Grid with Coordinated December 2025 Attack
In December 2025, a coordinated cyber attack disrupted multiple sites within Poland's national power grid, marking the first significant compromise of distributed energy operational technology in the region. The campaign, attributed with medium confidence to Russian state-sponsored APT group ELECTRUM, leveraged supply chain vulnerabilities and advanced lateral movement techniques to infiltrate the grid's OT networks. Attackers exploited unencrypted east-west traffic and segmentation gaps, enabling persistent access and operational disruption that triggered brief power outages and forced manual intervention by Polish operators. The incident showcased a notable escalation in critical infrastructure targeting methods by highly skilled actors. This incident highlights the increasing risk of state-sponsored attacks on energy infrastructure, especially in the context of rising geopolitical tensions and adversarial use of sophisticated supply chain compromise and network segmentation evasion. Organizations should reassess their visibility and controls for east-west and encrypted traffic to mitigate similar risks.
6 months ago
Kill Chain
Sandworm Wiper Campaign Frustrated at Poland Power Grid
In May 2024, cyber researchers reported a high-profile attack attempt targeting Poland’s power grid infrastructure. The operation was attributed to Sandworm, a Russian APT group notorious for wiper malware and sabotage against critical national infrastructure. Attackers leveraged custom malware designed to disrupt grid operations, but strong detection and security controls reportedly thwarted the attempt, preventing widespread outages. The incident highlighted Sandworm’s persistent focus on critical infrastructure in Central Europe and their evolving tactics for sabotaging operational technology environments. This case underscores a larger trend of state-aligned threat actors targeting energy and critical infrastructure in Europe, leveraging specialized wiper tools and lateral movement techniques. It also emphasizes increasing cross-border cyber risk as geopolitical tensions escalate and underscores new regulatory scrutiny for critical sectors.
6 months ago
Kill Chain
Sandworm’s Failed DynoWiper Attack on Poland’s Energy Grid: A 2025 Nation-State Case Study
In late December 2025, Polish energy infrastructure was targeted in a sophisticated cyberattack attributed to Sandworm, a notorious Russian state-sponsored hacking group. The attackers attempted to deploy 'DynoWiper', a destructive data-wiping malware, against two combined heat and power facilities and key management systems for renewable energy assets. Although the wiper aimed to erase files and render systems inoperable, Polish officials confirmed the attack was detected and mitigated before operational disruption occurred. Attribution to Sandworm, linked to Russia’s GRU, underscores continued targeting of critical infrastructure by advanced persistent threats. This incident is highly relevant given the continued escalation of cyber operations against national infrastructure, particularly in Europe. It highlights the evolving use of destructive malware by state-backed actors and signals the necessity for robust cross-sector cyber defenses and detection mechanisms.
6 months ago
Kill Chain
Sandworm’s DynoWiper Attack on Poland’s Power Grid: How Cyberdefenders Stopped a Nation-State Threat
In late December 2025, Poland’s power sector faced the largest cyberattack in its history, attributed to the notorious Russian state-backed Sandworm group. The attackers deployed a new destructive malware strain dubbed DynoWiper, attempting to disrupt critical energy operations by wiping systems within operational networks. Polish cyber defense teams identified the attack early through advanced threat monitoring and contained the threat before any operational damage occurred. No loss of service or data was reported, and authorities confirmed that core infrastructure remained uncompromised. The incident has intensified scrutiny of nation-state threats to Europe’s energy grid, reinforcing calls for resilient cybersecurity postures across all critical infrastructure assets. Sandworm’s use of a novel wiper malware and focus on lateral movement echo a sharp uptick in high-impact, geopolitically motivated attacks targeting EU utilities. This case highlights the growing sophistication and persistence of nation-state cyber operations, raising fresh challenges for defenders in the energy sector and beyond.
6 months ago
Kill Chain
Sandworm’s 2025 DynoWiper Attack on Poland’s Power Grid: Lessons in Critical Infrastructure Resilience
In late 2025, a highly targeted cyberattack attributed to the Sandworm group struck Poland's national power grid. Using custom data-wiping malware identified as DynoWiper, the attackers infiltrated critical infrastructure networks, demonstrating sophisticated knowledge of operational technology environments. The initial compromise involved lateral movement through segmented OT/IT networks, facilitated by exploitation of unprotected east-west traffic and weak segmentation controls. The subsequent deployment of DynoWiper caused destructive impacts, including service outages and loss of operational data across several regional substations, with cascading effects on grid stability and dependent sectors. Immediate containment was complicated by attacker persistence and the rapid spread of the wiper. This incident underscores the rising trend of advanced, nation-state wiper malware targeting critical infrastructure, reflecting a shift from espionage to destructive tactics. Organizations face elevated urgency to harden network segmentation, implement robust egress security, and adopt zero trust operational models in light of these evolving threats.
6 months ago
Kill Chain
Attackers Exploit GNU InetUtils Telnetd Flaw for Root Access in 2026
In January 2026, researchers discovered active exploitation of a critical eleven-year-old authentication bypass vulnerability (CVE-2026-24061) in the GNU InetUtils telnetd server, affecting versions 1.9.3 through 2.7. Attackers leveraged unsanitized environment variable handling to pass 'USER=-f root' via Telnet connections, trivially gaining root shell access without authentication. While identified exploitation was limited—18 unique IPs targeting 60 sessions over two days—many affected systems are legacy or embedded industrial and IoT devices, complicating patching or replacement and increasing exposure risk in Operational Technology (OT) environments. This incident highlights how long-standing vulnerabilities in rarely updated legacy software can be weaponized by both automated and hands-on attackers. The persistence of Telnet in OT, IoT, and embedded sectors, combined with publicly available exploits, underscores increased urgency for organizations to identify, mitigate, or segment such outdated services before broader exploitation occurs.
6 months ago
Kill Chain
Microsoft Uncovers 2026 Multi-Stage BEC Attack Targeting Energy Sector
In January 2026, Microsoft identified a sophisticated multi-stage business email compromise (BEC) attack targeting several prominent energy sector organizations. The attackers leveraged adversary-in-the-middle (AitM) phishing tactics, abusing SharePoint file-sharing services to distribute malicious payloads and gaining user trust with legitimate-looking links. Once initial access was achieved, the threat actors established persistent access by creating malicious inbox rules, allowing them to hijack email conversations, evade user detection, and execute fraudulent transactions. The campaign underscores the evolving nature of BEC schemes and their business impact, with potential exposure of sensitive data and financial losses. This incident exemplifies a significant escalation in the complexity and persistence of phishing-driven BEC campaigns affecting critical infrastructure. As regulatory scrutiny increases and attackers continually evolve tactics, this case highlights the urgent need for modern defenses against advanced social engineering and privileged access abuse.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports