The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Oil/Energy/Solar/Greentech
Breach intelligence, attack campaigns, and threat reports targeting the Oil/Energy/Solar/Greentech sector.
Explore Other Sectors
Oil/Energy/Solar/Greentech Threat Reports
EU and UK Sanction Russian GRU Hackers Over Cyberattacks
In July 2026, the European Union and the United Kingdom jointly imposed sanctions on Russian military intelligence officers and associated entities for orchestrating extensive cyberattacks across Europe. These operations, attributed to the GRU and FSB's 16th Centre, targeted government networks and critical infrastructure in countries including France, Germany, Poland, and Finland. Notably, the Turla hacking group, linked to the FSB, attempted to disrupt Poland's energy grid, potentially affecting 500,000 residents during winter. The sanctions encompass asset freezes and travel bans on individuals and entities involved in these cyberespionage activities. This incident underscores the escalating threat of state-sponsored cyberattacks on critical infrastructure, highlighting the need for enhanced cybersecurity measures and international cooperation to deter such activities. The coordinated response by the EU and UK reflects a growing consensus on the importance of addressing cyber threats through unified diplomatic and legal actions.
2 months ago
Kill Chain
US and Allies Issue Joint Advisory on Russian Cyber Threats to Critical Infrastructure
In July 2026, cybersecurity agencies from the United States and eight allied nations issued a joint advisory warning that Russian state-sponsored hackers, specifically FSB Center 16 (also known as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, and Static Tundra), are actively targeting vulnerable and poorly configured routers to infiltrate critical infrastructure networks. These actors exploit default or weak SNMP authentication strings and known vulnerabilities, such as CVE-2018-0171 in Cisco's Smart Install feature, to gain unauthorized access, exfiltrate configuration files, and conduct reconnaissance within victim networks. The sectors most at risk include energy, communications, defense industrial base, healthcare, financial services, and government services. This incident underscores the persistent threat posed by nation-state actors to critical infrastructure, highlighting the importance of proactive cybersecurity measures. Organizations are urged to upgrade to SNMPv3, disable unnecessary services like Cisco Smart Install, enforce strong unique passwords, block TFTP and SNMP traffic at edge firewalls, update software and firmware, and replace end-of-life devices to mitigate such risks.
2 months ago
Kill Chain
GigaWiper: A New Era of Modular Malware Threats
In October 2025, Microsoft identified GigaWiper, a sophisticated Golang-based backdoor that integrates multiple destructive capabilities, including disk wiping, fake ransomware, and system-level sabotage. This modular malware combines elements from various malware families, allowing attackers to execute a range of destructive actions on compromised Windows systems. GigaWiper's design enables threat actors to maintain control over infected systems, conduct surveillance, and deploy destructive payloads on demand, significantly increasing the potential impact of cyberattacks. ([csoonline.com](https://www.csoonline.com/article/4195470/microsoft-uncovers-gigawiper-a-backdoor-designed-for-destruction-on-demand.html?utm_source=openai)) The emergence of GigaWiper highlights a concerning trend towards more versatile and destructive malware, emphasizing the need for organizations to enhance their cybersecurity measures. The ability of such malware to perform both espionage and destruction underscores the importance of robust detection and response strategies to mitigate potential threats.
2 months ago
Kill Chain
Critical Vulnerability in Schneider Electric Easergy MiCOM Px40 Series: CVE-2026-4832
In April 2026, Schneider Electric disclosed a vulnerability (CVE-2026-4832) in its Easergy MiCOM Px40 Series protection relays. The flaw involves hard-coded credentials within the SNMP interface, allowing unauthenticated attackers to access sensitive device information. Affected models include Easergy MiCOM P14x, P24x, P341, and others, with versions prior to specific firmware updates being vulnerable. The vulnerability has a CVSS v4.0 score of 6.9, indicating a medium severity level. This incident underscores the critical importance of securing industrial control systems against unauthorized access. The use of hard-coded credentials is a known security risk, and organizations must prioritize updating firmware and implementing network protections to mitigate such vulnerabilities.
2 months ago
Kill Chain
OpenPLC v3 Vulnerability CVE-2026-14480: A Critical Threat to Industrial Control Systems
In July 2026, a critical vulnerability (CVE-2026-14480) was identified in OpenPLC v3, an open-source programmable logic controller widely used in industrial control systems. This flaw allows authenticated attackers to write arbitrary files to the filesystem, potentially leading to remote code execution with the privileges of the OpenPLC runtime user. Exploitation could result in unauthorized control over industrial processes, posing significant risks to critical infrastructure sectors such as manufacturing, energy, transportation, and water systems. The discovery of this vulnerability underscores the ongoing challenges in securing industrial control systems, especially those relying on open-source solutions. As cyber threats targeting critical infrastructure continue to evolve, it is imperative for organizations to proactively assess and mitigate vulnerabilities to prevent potential disruptions and ensure operational resilience.
2 months ago
Kill Chain
Hydro-Québec Charging Station Vulnerabilities Highlight Critical Infrastructure Risks
In July 2026, Hydro-Québec's Le Circuit Electrique charging station backend was found to have multiple critical vulnerabilities, including improper access control, insufficient session expiration, and lack of throttling on authentication attempts. These flaws could allow attackers to escalate privileges or execute denial-of-service attacks, potentially disrupting electric vehicle charging services across Canada. Hydro-Québec has since updated the majority of charging stations to disable the Open Charge Point Protocol (OCPP) and implemented authentication systems to mitigate these risks. This incident underscores the growing cybersecurity challenges in the electric vehicle infrastructure sector. As the adoption of EVs accelerates, ensuring the security of charging networks becomes paramount to prevent potential disruptions and maintain public trust in sustainable transportation solutions.
2 months ago
Kill Chain
Critical Vulnerability in Hitachi Energy's PROMOD V: CVE-2026-10763
In June 2026, Hitachi Energy disclosed a vulnerability (CVE-2026-10763) in its PROMOD V software, which utilized unencrypted HTTP communication due to the lack of HTTPS support from a third-party Digipede server. This flaw exposed sensitive data to potential interception and manipulation, posing risks such as credential theft and unauthorized access. The affected versions include PROMOD V up to 1.0.10. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-10763?utm_source=openai)) This incident underscores the critical importance of secure communication protocols in industrial control systems. Organizations are urged to review their software dependencies and ensure that all components support encrypted communications to mitigate similar vulnerabilities.
2 months ago
Kill Chain
Critical Vulnerability in Hitachi Energy e-mesh EMS: CVE-2026-42945
In July 2026, Hitachi Energy disclosed a critical vulnerability (CVE-2026-42945) in its e-mesh EMS versions 4.1.6, 4.4.2, and 4.7.0. This heap-based buffer overflow in the NGINX component's ngx_http_rewrite_module allows unauthenticated attackers to send crafted HTTP requests, potentially leading to application crashes and arbitrary code execution. The vulnerability arises when specific rewrite directives are used with unnamed PCRE captures and replacement strings containing a question mark. ([windowsforum.com](https://windowsforum.com/threads/cve-2026-42945-nginx-heap-overflow-hits-hitachi-energy-e-mesh-ems.435597/?utm_source=openai)) This incident underscores the risks of integrating widely-used web components like NGINX into critical infrastructure systems. Organizations must prioritize patching affected systems and reviewing configurations to mitigate potential exploitation, especially in environments where operational technology intersects with standard web technologies.
2 months ago
Kill Chain
Iranian Hackers Target U.S. Industrial Control Systems in 2026
In early 2026, Iranian state-sponsored hackers launched a series of cyberattacks targeting U.S. critical infrastructure, focusing on industrial control systems (ICS) such as Rockwell Automation's Allen-Bradley programmable logic controllers (PLCs). These attacks exploited vulnerabilities in internet-exposed devices, leading to operational disruptions and potential safety hazards across sectors like water treatment and energy. ([nextgov.com](https://www.nextgov.com/cybersecurity/2026/04/pro-iran-hackers-are-targeting-us-industrial-control-systems-advisory-says/412679/?oref=ng-homepage-river&utm_source=openai)) This incident underscores the escalating threat landscape for ICS environments, highlighting the urgent need for organizations to secure operational technology assets against sophisticated nation-state actors. ([cybersecuritydive.com](https://www.cybersecuritydive.com/news/critical-infrastucture-plcs-iran-hacking-censys/817209/?utm_source=openai))
2 months ago
Kill Chain
Armored Likho's 2026 Cyber-Espionage Campaign: BusySnake Infostealer Targets Critical Infrastructure
In July 2026, the previously unknown APT group 'Armored Likho' launched sophisticated cyber-espionage campaigns targeting government agencies and electric power entities in Russia, Brazil, and Kazakhstan. Utilizing spear-phishing emails disguised as official communications, they deployed the Python-based 'BusySnake' infostealer to exfiltrate sensitive data, including credentials and cryptographic keys. The malware's advanced obfuscation techniques and modular architecture enabled persistent access and evasion of detection mechanisms. This incident underscores the escalating threat posed by APT groups leveraging AI-generated malware to target critical infrastructure. Organizations must enhance their cybersecurity posture to defend against such evolving tactics.
2 months ago
Kill Chain
Critical Vulnerabilities in FatFs Expose Millions of Embedded Devices
In July 2026, security firm runZero disclosed seven vulnerabilities in FatFs, a widely used filesystem library for FAT and exFAT formats. These flaws, present in devices like security cameras, drones, and industrial controllers, allow attackers to exploit crafted storage media to corrupt memory and execute arbitrary code. The vulnerabilities, rated Medium to High severity, include issues like integer overflows and buffer overflows, leading to potential device crashes or unauthorized code execution. Notably, CVE-2026-6682 involves an integer overflow during FAT32 volume mounting, which can result in memory corruption and code execution. ([thehackernews.com](https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html?utm_source=openai)) The widespread use of FatFs in embedded systems, combined with the lack of upstream fixes and the absence of a responsive maintainer, poses significant security risks. Devices relying on FatFs remain vulnerable, and the exploitation of these flaws could lead to persistent operational denial of service or device bricking. Organizations must assess their exposure and implement mitigations to protect against potential attacks. ([thehackernews.com](https://thehackernews.com/2026/07/unpatched-flaws-disclosed-in-filesystem.html?utm_source=openai))
2 months ago
Kill Chain
Armored Likho's BusySnake Stealer Targets Government and Energy Sectors
In July 2026, a previously undocumented threat actor known as Armored Likho launched cyber attacks targeting government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. The group employed spear-phishing emails with lures related to official government notices or social programs, distributing RAR archives containing EXE binaries that served as droppers for additional payloads retrieved from a GitHub repository. These payloads included a newly identified Python-based information stealer named BusySnake Stealer, which is capable of stealing browser passwords, cookies, clipboard contents, screenshots, documents, Telegram session data, OTP secrets, and cryptocurrency wallet files. The malware establishes persistence through a combination of VBScript files and scheduled tasks, allowing the attackers to maintain prolonged access to compromised systems. This incident underscores the evolving tactics of cyber espionage groups, highlighting their ability to blend financially motivated campaigns with targeted attacks on critical infrastructure. The use of AI-generated first-stage loaders and obfuscated, modular remote access trojans (RATs) and infostealers specifically engineered to bypass dynamic analysis demonstrates a significant advancement in their capabilities. Organizations must remain vigilant and adapt their cybersecurity measures to counter these sophisticated threats.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports