✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Oil/Energy/Solar/Greentech
Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.
Explore Other Sectors
Oil/Energy/Solar/Greentech Threat Reports
How Zigbee Protocol Flaws Exposed Industrial IoT Networks in 2024
In early 2024, security researchers uncovered critical vulnerabilities affecting Zigbee-based industrial IoT and automation environments. By assessing real-world installations, attackers demonstrated how both spoofed packet injection and coordinator impersonation attacks could exploit application-layer protocol weaknesses and misconfigurations. Notably, exposed or hard-coded keys, absence of end-to-end encryption, and insecure default settings enabled adversaries to hijack communications, control relay devices, and ultimately compromise entire sensor networks. The attack techniques bypassed traditional network segmentation and leveraged custom wireless tools to overcome timing and profile mismatches. This incident highlights urgent gaps in IoT and industrial security — especially the risks posed by legacy or proprietary protocol deployments lagging on best-practice cryptographic implementation. With industrial sectors increasingly reliant on automated sensor networks, attackers are expanding TTPs to target low-power wireless protocols like Zigbee, making advanced monitoring and zero trust approaches more critical than ever.
6 months ago
Kill Chain
CISA Flags Exploited Vulnerability in Sierra Wireless AirLink ALEOS (CVE-2018-4063)
On December 12, 2025, CISA added CVE-2018-4063, a vulnerability impacting Sierra Wireless AirLink ALEOS, to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. This vulnerability allows unrestricted upload of potentially malicious files, granting attackers the ability to gain remote control over affected network devices. Such vulnerabilities in network infrastructure expose organizations—including federal agencies—to heightened risks of unauthorized access, lateral movement, and disruption of operations. Federal Civilian Executive Branch agencies are mandated to remediate this issue promptly under Binding Operational Directive 22-01, and CISA encourages all enterprises to act urgently in their own environments. This incident highlights the persistent targeting of edge network infrastructure by threat actors, a trend accelerated by increased reliance on remote and distributed operations. The rapid inclusion of this vulnerability in CISA’s KEV Catalog underscores the growing regulatory and operational pressure on organizations to adopt proactive vulnerability and network segmentation controls.
6 months ago
Kill Chain
CISA Adds OSGeo GeoServer CVE-2025-58360 to Known Exploited Vulnerabilities List
In December 2025, CISA added CVE-2025-58360, an Improper Restriction of XML External Entity Reference vulnerability in OSGeo GeoServer, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming evidence of active exploitation in the wild. The vulnerability allows remote attackers to exploit XML parsing weaknesses to access sensitive data or execute arbitrary code by submitting malicious crafted XML to the GeoServer platform, which is widely used for geospatial data services. Malicious actors leveraging this flaw can bypass security controls, potentially leading to significant data breaches or operational disruption across organizations dependent on GeoServer. This incident highlights the increasing urgency of remediating software supply chain and core infrastructure vulnerabilities exploited in real-world attacks. The active exploitation of such high-impact flaws is driving regulatory entities and private organizations to re-examine patch management, incident response, and zero trust controls for critical applications.
6 months ago
Kill Chain
AzeoTech DAQFactory 2025: Critical ICS Memory Flaws Open Path to Code Execution
In December 2025, critical memory corruption vulnerabilities were disclosed in AzeoTech DAQFactory, an industrial control system platform widely used in critical manufacturing. Attackers leveraging these flaws—such as out-of-bounds write, use-after-free, heap and stack buffer overflows, and type confusion—could upload malicious .ctl files, leading to potential arbitrary code execution or data disclosure. No remote exploitation was reported, but the flaws affect DAQFactory versions 20.7 (Build 2555) and earlier, impacting deployments worldwide. The incident underscores the persistent risk that memory-based vulnerabilities pose to ICS platforms, amplifying concerns about supply chain and file-based attacks in operational environments. Given ICS’s expanding attack surface and recent regulatory scrutiny, addressing patch management and limiting untrusted file handling remain crucial for minimizing operational risk.
6 months ago
Kill Chain
CSRF Flaw in OpenPLC_V3 Sheds Light on ICS Software Security Risks
In December 2025, a significant cybersecurity vulnerability was disclosed in OpenPLC_V3, an open-source programmable logic controller widely deployed in critical infrastructure sectors such as manufacturing, energy, transportation, and water systems. Researchers identified a Cross-Site Request Forgery (CSRF) flaw (CVE-2025-13970) that allowed remote, unauthenticated attackers to exploit absent CSRF protections, potentially tricking logged-in administrators into modifying PLC settings or uploading malicious code. This could have caused disruptive or destructive changes to industrial processes. A patch was promptly released via pull request #310, and no evidence of public exploitation has been reported to date. The incident underscores growing threats to industrial control system (ICS) environments, as attackers increasingly target device management interfaces. Regulatory and industry attention remains high, amplifying requirements for strong authentication, network segmentation, and timely vulnerability management for ICS software.
6 months ago
Kill Chain
Critical Vulnerabilities in Siemens SINEMA Remote Connect Server Expose Manufacturing Networks
In December 2025, Siemens disclosed two vulnerabilities impacting SINEMA Remote Connect Server versions prior to V3.2 SP4, designated as CVE-2025-40818 and CVE-2025-40819. The flaws involved incorrect permission assignments for SSL/TLS private keys and improper authorization controls over license management within the server's database. An authenticated attacker could exploit these weaknesses to impersonate trusted servers, decrypt or intercept sensitive communications, and bypass licensing restrictions, exposing critical manufacturing environments worldwide to unauthorized access and operational risk. This incident underscores the persistent importance of robust permission management and encryption key protection in industrial control systems. With increased targeting of operational technology environments, organizations must prioritize patching, secure configurations, and risk assessments to maintain both compliance and resilience against escalating threats.
6 months ago
Kill Chain
CISA’s 2025 ICS Advisories Expose Critical OT Vulnerabilities
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) published 12 critical advisories detailing multiple vulnerabilities affecting industrial control systems (ICS) from major vendors including Johnson Controls, Siemens, and Varex Imaging. These advisories highlight flaws exposed by threat assessments in device firmware, authentication mechanisms, remote access features, and legacy software within widely deployed ICS/OT products. An exploitation of these vulnerabilities could give adversaries access to critical operations, enable lateral movement within secure networks, or disrupt essential physical processes that underpin energy, healthcare, and manufacturing sectors. The occurrence underscores the ongoing risks posed by legacy and unpatched OT technology in critical infrastructure. A surge in targeted attacks against ICS environments, evolving regulatory requirements, and new threat intelligence guidance are elevating urgency for rapid remediation, modern zero trust approaches, and the adoption of robust segmentation and visibility controls.
6 months ago
Kill Chain
Siemens Discloses Physical Access Flaw in 2025 G5DFR Devices
In December 2025, Siemens Energy Services disclosed a critical vulnerability in all G5DFR versions of its Elspec G5 devices, affecting industrial control systems worldwide. Attackers with physical access could reset the Admin password by inserting a USB drive containing a public reset string, effectively bypassing authentication (CVE-2025-59392, CVSS 7.0). While exploitation required direct device access, successful attacks would allow unauthorized changes to critical system configurations, risking operational integrity within the energy sector. Siemens and CISA advised urgent firmware updates and robust network isolation to mitigate the risk. This incident highlights the persistent risk of physical-layer threats in critical infrastructure environments, even as digital attack surfaces expand. The availability of public reset procedures underscores the urgency in securing endpoints and the importance of layered, defense-in-depth strategies, especially given the evolving regulatory landscape and increased scrutiny on energy sector cybersecurity.
6 months ago
Kill Chain
Siemens SALT Toolkit Flaw Leaves Industrial Systems Exposed to MITM Attacks
In December 2025, Siemens disclosed a critical vulnerability (CVE-2025-40801) in its Advanced Licensing (SALT) Toolkit, affecting multiple industrial software products such as COMOS, NX, Simcenter, and Tecnomatix. The flaw—improper certificate validation in the SALT SDK when establishing TLS connections—could enable unauthenticated remote attackers to launch man-in-the-middle attacks. With a CVSS v4 score of 9.2, exploitation risk is high, potentially allowing attackers to intercept or manipulate sensitive industrial data and processes in critical manufacturing environments globally. Patches have been released for some products, but others remain without a fix. This incident is significant as it highlights ongoing challenges in implementing secure communication protocols within the industrial sector. The vulnerability underscores a wider trend of attackers exploiting flaws in authentication and encryption controls, emphasizing the urgent need for robust zero trust segmentation, encrypted traffic policies, and active vulnerability management as industries modernize.
6 months ago
Kill Chain
Authentication Bypass Exposes Siemens Gridscale X Prepay ICS: 2025 Breach Analysis
In December 2025, Siemens disclosed critical vulnerabilities impacting its Gridscale X Prepay solution, widely used in energy infrastructure. The flaws—an observable response discrepancy (CVE-2025-40806) and authentication bypass via capture-replay (CVE-2025-40807)—could allow remote attackers to enumerate valid user names and circumvent lockouts, compromising operational security. Discovered by Kira of The Raven Security and coordinated via Siemens ProductCERT and CISA, these issues placed globally deployed ICS systems at risk of unauthorized access by leveraging predictable system responses and token replay, potentially impacting sensitive control environments. This incident highlights an ongoing trend of attackers exploiting authentication weaknesses in industrial control systems, underscoring the need for strict access management and timely vulnerability mitigation. With ICS assets increasingly targeted and regulatory scrutiny rising, implementing robust segmentation and monitoring is more crucial than ever.
6 months ago
Kill Chain
Ukrainian Hacker Charged: Russian Hacktivist Attacks Underscore U.S. Critical Infrastructure Risks
In 2024, U.S. authorities charged a Ukrainian national for collaborating with Russian state-sponsored hacktivist groups in a series of high-profile cyberattacks against critical infrastructure. The targeted sectors included U.S. water systems, election infrastructure, and nuclear facilities. Leveraging advanced intrusion tools and lateral movement tactics, the attacker contributed to sophisticated campaigns aimed at espionage, disruption, and potential sabotage. These efforts underscore the persistent threat posed by coordinated state-aligned cyber actors and the increasing risk to essential public services worldwide. This case highlights how modern threat actors are expanding their focus from traditional targets to critical infrastructure with geo-political motives. The intersection of hacktivism, nation-state support, and escalating global tensions demands greater cyber defense readiness and robust compliance from both private and public sectors.
6 months ago
Kill Chain
Opportunistic Pro-Russia Hacktivist Attacks on Critical Infrastructure (2025)
In May and December 2025, joint advisories from CISA, FBI, NSA, Department of Energy, and international partners highlighted a surge in opportunistic attacks on US and global critical infrastructure mounted by pro-Russia hacktivist groups such as Cyber Army of Russia Reborn, Z-Pentest, NoName057(16), and Sector16. These actors leveraged poorly secured, internet-facing Virtual Network Computing (VNC) connections to infiltrate operational technology (OT) systems, targeting assets ranging from water treatment plants to energy and pipeline operators. The attacks, while generally less sophisticated than those carried out by advanced persistent threat (APT) groups, resulted in varying degrees of impact including service disruptions and, in some cases, physical damage to critical assets. This campaign reflects a growing trend of hacktivist groups exploiting low-hanging vulnerabilities in OT environments, often amplifying their impact through sensationalist or exaggerated public claims. The continued prevalence of exposed VNC devices and basic authentication weaknesses underscores the importance for asset owners and operators to harden access, enforce strong authentication, and monitor for anomalous activities to combat evolving hacktivist TTPs.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports